EUVD-2026-81687Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable OIDC flow (AV:N); AC:H because it needs a multi-connection dynamic_oidc config plus a controllable/known subject collision; PR:N since the attacker never authenticates to the victim app; full account takeover gives C:H/I:H, A:N.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection.
The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "<name>/<connection_id>", but that namespacing never takes effect. __connection_id__ is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose __connection_id__ is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space.
This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.
AnalysisAI
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-provider connection of a dynamic_oidc strategy be signed in as a local user whose identity row was created through a different IdP connection, because the intended per-connection namespacing of the strategy field never persists. Affected are versions 5.0.0-rc.10 through 5.0.0-rc.13 (fixed in 5.0.0-rc.14); the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, so the flaw is network-reachable and unauthenticated in the token-presentation sense, but real-world exploitation is tightly gated: the deployment must use dynamic_oidc with more than one identity-provider connection, the attacker must control (or have a trusted operator position on) one of those connections, and must be able to mint tokens with a chosen sub claim that collides with a target subject. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to use the dynamic_oidc strategy of ash_authentication (versions 5.0.0-rc.10 through 5.0.0-rc.13) configured with more than one identity-provider connection, and the attacker must be able to operate/control at least one of those connections and mint tokens with a chosen 'sub' claim. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication-bypass/account-takeover flaw (CWE-290) but its real-world reach is tightly gated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to ash_authentication 5.0.0-rc.14, which contains the fix; the relevant upstream commits are 73ad16e452670bbf843550a13361bd41e72ad964 (patch) and 64530644f9b37ebb76ca14aeb83a77597a0034b7 (which documents the new `trust_email_verified?` and `on_untrusted_email_match` DSL options), and the advisory is at https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-73j9-m294-fvv9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service that depends on ash_authentication and determine which ones run the dynamic_oidc strategy with more than one identity-provider connection; for any instance on versions 5.0.0-rc.10, 5.0.0-rc.11, 5.0.0-rc.12, or 5.0.0-rc.13, upgrade to the vendor-released fixed version 5.0.0-rc.14 or later and redeploy, and where an immediate upgrade is not possible, temporarily reduce each affected deployment to a single trusted identity-provider connection or disable dynamic_oidc multi-connection support as an interim measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoen
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity c
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust ser
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.1
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today