# CVE-2026-66882: team-alembic AshAuthentication reflected XSS in confirmation forms

Source: https://junglewise.ai/threats/cve-2026-66882-team-alembic-ashauthentication-reflected-xss-in-confirmation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66882 · Severity: info · CVSS 6.1 · Published 2026-08-25

AshAuthentication is an authentication framework used in web applications. A reflected cross-site scripting (XSS) vulnerability in its confirmation and sign-in form pages allows an attacker to inject malicious JavaScript that executes in a user's browser when they follow a crafted link. This could lead to theft of authentication cookies, session hijacking, or credential capture if a victim clicks a malicious confirmation or sign-in link that appears legitimate.

## Quick answers

**Is CVE-2026-66882 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66882 being exploited in the wild.

**How severe is CVE-2026-66882?** Informational severity, with a CVSS score of 6.1, published 25 August 2026.

**Which products and versions are affected?** team-alembic AshAuthentication 4.8.0 to 4.14.1, 5.0.0-rc.0 to 5.0.0-rc.12.

**Is there a fix for CVE-2026-66882?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66882 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66882?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected XSS in the confirm and magic_link form pages of AshAuthentication. The root cause is that request parameters (the confirm parameter in confirmation_form.html.eex and the magic link token parameter in sign_in_form.html.eex) are interpolated directly into hidden input value attributes using unescaped EEx templates (<%= %>) without HTML entity encoding. The accept handlers in both Confirmation.Plug and MagicLink.Plug do not validate or sanitize the parameter values before rendering, and the magic link handler does not verify token signatures at this stage. The attack vector is a crafted GET request; an unauthenticated attacker can terminate the attribute with a quote and inject a <script> element or other markup, which executes in the victim's browser in the application origin's context. The injected script gains access to cookies, session tokens, and same-origin data. Patches are available in versions 4.14.2 and 5.0.0-rc.13 or later.

## Affected products

- team-alembic AshAuthentication 4.8.0 to 4.14.1, 5.0.0-rc.0 to 5.0.0-rc.12

## Timeline

- 2026-08-25: disclosed