CVE-2026-49757: team-alembic AshAuthentication auth bypass in OAuth2/OIDC sign-in

CVE-2026-49757 · Severity: critical · CVSS 9.2 · Published 2026-06-15

AshAuthentication is an authentication library for Elixir applications that integrates OAuth2 and OpenID Connect providers. The library incorrectly identifies users by email address rather than the secure `iss`/`sub` claim pair, allowing an attacker with access to a victim's email address on any OAuth provider to log in as that victim and gain full control of their account, including read, write, and delete permissions.

Technologies: Alembic AshAuthentication. Vendors: Alembic.

Quick answers

Is CVE-2026-49757 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49757 being exploited in the wild.
How severe is CVE-2026-49757?
Critical severity, with a CVSS score of 9.2, published 15 June 2026.
Which products and versions are affected?
Alembic AshAuthentication 0.1.0 to 4.13.9, 5.0.0-rc.0 to 5.0.0-rc.9.
Is there a fix for CVE-2026-49757?
A patch was published on 2026-06-15: Patches released: version 4.14.0 (4.x branch) and 5.0.0-rc.10 (5.x branch) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49757 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49757?
Check whether you run Alembic AshAuthentication at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass (CWE-290) in AshAuthentication's OAuth2/OIDC registration and sign-in flow. Per OpenID Connect Core §5.7, user identity must be established via the `iss`/`sub` claim pair, not email. AshAuthentication's `IdentityChange:change/3` and `SignInPreparation:prepare/3` functions instead perform upsert and lookups on the email field alone. An attacker registers an account on an OAuth/OIDC provider (Slack, generic OIDC, or any provider with weak email verification) using the victim's email, then completes the OAuth flow against the target AshAuthentication application. The library matches the attacker's session to the victim's existing account by email, granting the attacker a session token. The attack requires network access to the OAuth flow and a provider that either lacks email verification, allows email reuse, or permits account reclamation. Patches are available in AshAuthentication 4.14.0 and 5.0.0-rc.10.

Affected products

  • team-alembic ash_authentication >= 0.1.0, < 4.14.0; >= 5.0.0-rc.0, < 5.0.0-rc.10

Identifiers

  • CVE-2026-49757
  • GHSA-777c-2fxx-qr28

Timeline

  • 2026-06-15: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-08-25: advisory: Updated advisory with full details
  • 2026-06-15: patched: Patches released: version 4.14.0 (4.x branch) and 5.0.0-rc.10 (5.x branch)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.