CVE-2026-82685: Confirmation token accepted on any record in AshAuthentication
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record.
AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with forcechangeattributes/2 and stamping confirmedat, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.
This issue affects ashauthentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 4.15.0 - Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.14
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are ash_authentication 0.5.0 through versions before 4.15.0, and 5.0.0-rc.0 through versions before 5.0.0-rc.14. The issue is in AshAuthentication.AddOn.Confirmation.ConfirmChange.
What does an attacker need to exploit this?
The attacker must be authenticated and able to register or use their own account, change its email address, and obtain the resulting confirmation token. They then replay that token while targeting another user's record ID, and can use a normal password-reset flow after changing and confirming the victim account's email.
Is the standard AshAuthentication confirmation flow vulnerable?
No. The library's AshAuthentication.AddOn.Confirmation.Actions.confirm/3 flow resolves the token's sub claim to a user and targets that user record, so it is not affected by this token-to-record mismatch.