Executive brief
AshAuthentication is an authentication library for Elixir applications that integrates OAuth2 and OpenID Connect providers. The library incorrectly identifies users by email address rather than the secure `iss`/`sub` claim pair, allowing an attacker with access to a victim's email address on any OAuth provider to log in as that victim and gain full control of their account, including read, write, and delete permissions.
Technical details
The vulnerability is an authentication bypass (CWE-290) in AshAuthentication's OAuth2/OIDC registration and sign-in flow. Per OpenID Connect Core §5.7, user identity must be established via the `iss`/`sub` claim pair, not email. AshAuthentication's `IdentityChange:change/3` and `SignInPreparation:prepare/3` functions instead perform upsert and lookups on the email field alone. An attacker registers an account on an OAuth/OIDC provider (Slack, generic OIDC, or any provider with weak email verification) using the victim's email, then completes the OAuth flow against the target AshAuthentication application. The library matches the attacker's session to the victim's existing account by email, granting the attacker a session token. The attack requires network access to the OAuth flow and a provider that either lacks email verification, allows email reuse, or permits account reclamation. Patches are available in AshAuthentication 4.14.0 and 5.0.0-rc.10.
Affected products
- team-alembic ash_authentication >= 0.1.0, < 4.14.0; >= 5.0.0-rc.0, < 5.0.0-rc.10
Timeline
- 2026-06-15: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-25: advisory: Updated advisory with full details
- 2026-06-15: patched: Patches released: version 4.14.0 (4.x branch) and 5.0.0-rc.10 (5.x branch)