CVE-2026-66882: XSS
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms.
When a strategy is configured with requireinteraction? set to true, AshAuthentication serves an intermediate HTML page asking the user to confirm the action by submitting a form. Both such pages embed a request parameter directly into a hidden input's value attribute without HTML escaping: lib/ashauthentication/addons/confirmation/confirmationform.html.eex interpolates the confirm parameter, and lib/ashauthentication/strategies/magiclink/signinform.html.eex interpolates the magic link token parameter. These templates are compiled with EEx.functionfromfile/3 using plain <%= %> expressions, which perform no escaping, so the parameter is reflected verbatim.
Neither accept handler validates the value before rendering it. AshAuthentication.AddOn.Confirmation.Plug.accept/2 only checks that a confirm key is present, and AshAuthentication.Strategy.MagicLink.Plug.accept/2 reads the parameter directly, so no token signature is verified at this stage and arbitrary attacker-supplied text reaches the template. An unauthenticated attacker can therefore craft a URL whose parameter terminates the attribute and injects markup, for example a quote followed by a <script> element. Because the accept phase is served over GET, loading the crafted link is sufficient; no form submission or prior authentication is required.
The injected script executes in the origin of the application embedding AshAuthentication, giving it access to that origin's cookies, session, and same-origin responses. Since these pages are part of the authentication flow, a victim following what appears to be a legitimate confirmation or sign-in link is a plausible target.
This issue affects ashauthentication: from 4.8.0 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
team-alembic AshAuthenticationto a version that resolves this vulnerability.Fixed in 4.14.2 - Upgrade
Upgrade
team-alembic AshAuthenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.13 - Compensating control
Restrict/monitor access to the authentication flow endpoints that accept the crafted GET parameters (confirmation and magic link interaction forms) to reduce exposure to unauthenticated reflected XSS payload delivery.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the confirmation or magic-link interaction flow with require_interaction? set to true are exposed, because those flows render an intermediate confirmation form.
What does an attacker need to exploit it?
An attacker can supply an arbitrary confirm parameter or magic-link token parameter and must induce a user to access and interact with the rendered page. No attacker privileges are required.
Does the magic-link token need to be valid or signed before the vulnerable page is rendered?
No. The magic-link accept handler reads the parameter directly before rendering, without verifying a token signature at that stage. The confirmation handler only checks that the confirm key is present.