Executive brief
AshAuthentication is an authentication library used in web applications to handle user sign-in and registration via OAuth2 providers. A flaw in its OAuth2 logic allows an attacker to take over any user account by linking an OAuth2 identity without properly validating that the email addresses match, then gain session access as that account. The vulnerability also overwrites the victim's email address with the attacker's, blocking legitimate account recovery.
Technical details
The vulnerability exists in AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 and OAuth2.SignInPreparation. When matching an incoming OAuth2 identity to an existing user account, the code uses upsert_identity keys (which may not be email) to find the account, then gates the identity link on email_trusted?/2. However, email_trusted?/2 only checks the provider's email_verified boolean and never compares the provider's email address with the matched account's email. This allows an attacker with a verified email at their own OAuth2 provider to be linked to and issued a session for any account matched on a non-email attribute. Additionally, the upsert operation rewrites the victim account's email to the attacker's address, preventing legitimate password recovery. The vulnerability affects versions 4.14.0–4.14.x and 5.0.0-rc.10–5.0.0-rc.13.
Affected products
- team-alembic AshAuthentication 4.14.0 before 4.15.0, 5.0.0-rc.10 before 5.0.0-rc.14
Timeline
- 2026-09-17: disclosed