CVE-2026-49757: Authentication Bypass and Account Takeover in ash_authentication OAuth2/OIDC
Vulnerability ID: CVE-2026-49757
CVSS Score: 9.2
Published: 2026-08-25
An authentication bypass and account takeover vulnerability in the AshAuthentication Elixir library (developed by team-alembic) allows unauthenticated remote attackers to compromise local accounts. By relying on mutable and unverified email claims instead of stable cryptographic issuer and subject pairings during OAuth2 and OIDC federated login flows, the application fails to validate the trust boundary of the incoming session.
TL;DR
Unauthenticated remote account takeover via federated login using unverified email claims in the AshAuthentication Elixir library.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-290
- Attack Vector: Network (AV:N)
- CVSS v4.0: 9.2 (Critical)
- Exploit Status: Proof of Concept Available
- Impact: Authentication Bypass / Account Takeover
- EPSS Score: 0.00615
- CISA KEV Status: Not Listed
Affected Systems
- ash_authentication (Elixir Package)
-
ash_authentication: >= 0.1.0, < 4.14.0 (Fixed in:
4.14.0) -
ash_authentication: >= 5.0.0-rc.0, < 5.0.0-rc.10 (Fixed in:
5.0.0-rc.10)
Code Analysis
Commit: 6453064
Fix OAuth sign-in identity matching for v5.0
UserIdentity.Actions.upsert(strategy.identity_resource, %{user_id_attribute_name => user.id})
Commit: 728b8d2
Fix OAuth sign-in identity matching for v4.14
UserIdentity.Actions.upsert(strategy.identity_resource, %{user_id_attribute_name => user.id})
Exploit Details
- GitHub: Proof of concept verifying authentication bypass via unverified email claims in OAuth2 flows.
Mitigation Strategies
- Enforce mandatory identity_resource setting in ash_authentication settings
- Set trust_email_verified? to false for generic, non-trusted OAuth providers
- Use on_untrusted_email_match set to :reject or :confirm to mandate additional verification steps
- Perform migration of database indexes to establish a unique constraint on (strategy, uid)
Remediation Steps:
- Upgrade dependencies in mix.exs to ash_authentication v4.14.0 or v5.0.0-rc.10
- Run mix deps.get to fetch the updated packages
- Generate migrations for user identity tables using mix ash.codegen require_user_identity_unique_key
- Apply database modifications using mix ash.migrate
- Configure OAuth strategies within User resource to require identity_resource and specify validation flags
References
- GHSA-777c-2fxx-qr28 Security Advisory
- Erlang Ecosystem Foundation Advisory
- OSV Vulnerability Record
- NVD Vulnerability Details
Read the full report for CVE-2026-49757 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)