EUVD-2026-81484Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because the attacker needs a valid token for one resource; AC:H because it depends on a non-default multi-resource design sharing PK field names; full cross-resource takeover gives C:H/I:H, A:N.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.
AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.
This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid sign-in token minted for one Ash resource replay it to be signed in as a user of a different resource, because the JWT 'sub' claim's path segment - the only portion recording which subject the token was issued for - is parsed with URI.parse/1 and thrown away, leaving only the query string. Affected are ash_authentication releases from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14, specifically the Password sign-in-with-token, WebAuthn sign-in and remember-me preparations; the magic-link sign-in path pins the subject against the resource and is not vulnerable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires ALL of: (1) the attacker holds a valid, unexpired sign-in token for at least one authenticated resource (PR:L - must already be a legitimate user of some resource); (2) the application defines two or more authenticated Ash resources whose primary-key FIELD NAMES are identical across resources (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication bypass (CWE-287), not a mislabeled authorization issue, corroborated by the vendor advisory (GHSA-3pr8-f99q-86hp), the ERLEF/EEF CNA record, OSV, and three patch commits - high source agreement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade ash_authentication to 4.15.0 or later on the 4.x line, or to 5.0.0-rc.14 or later on the 5.x pre-release line - these are the first fixed versions for their respective ranges. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using the AshAuthentication library for Elixir/Ash and identify those running affected versions: any release from 3.10.5 up to but not including 4.15.0, or from 5.0.0-rc.0 up to but not including 5.0.0-rc.14. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoen
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity c
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust ser
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.1
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today