CVE-2026-85500: `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement.
AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by requireconfirmedwith is set using a bare isnil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i
requireconfirmedwith is enforced in two places, and neither holds in every configuration. signinwithtoken and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets selectbydefault?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed.
This issue affects ashauthentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 4.15.0 - Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.14 - Configuration
Update AshAuthentication so require_confirmed_with is always checked on the action execution path, and treat %Ash.NotLoaded{} and %Ash.ForbiddenField{} as a failed confirmation rather than skipping the rejection branch due to is_nil(Map.get(user, value)).
AshAuthentication.Strategy.Password.Actions.check_user/2 require_confirmed_with enforcement = ensure required_confirmed_with is enforced on the action itself (not only inside sign_in_with_token and register checks) and does not fail open when the attribute is %Ash.NotLoaded{} or %Ash.ForbiddenField{}
Event History
Frequently Asked Questions
Are deployments using AshGraphql or AshJsonApi affected by default?
Yes. These API layers invoke the action directly, which bypasses checks that exist only inside AshAuthentication.Strategy.Password.Actions; the issue applies to the default configuration.
What does an attacker need to exploit this?
An unconfirmed user can obtain a session when the confirmation requirement is bypassed. Direct invocation of the relevant action skips the check entirely.
Can the confirmation check fail even when it is reached?
Yes. If the confirmation attribute is not loaded, Map.get/2 returns %Ash.NotLoaded{}; if a field policy denies access, it returns %Ash.ForbiddenField{}. Because neither value is nil, the rejection branch is skipped.