CVE-2026-91039: dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection.
The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "<name>/<connectionid>", but that namespacing never takes effect. connectionid is populated only on the ephemeral runtime struct built per request in dynamicoidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategyforaction, yielding the persisted struct whose connectionid is its defstruct default of nil. OAuth2.identitystrategyname/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/userresolver.ex and oauth2/signinpreparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space.
This issue affects ashauthentication: from 5.0.0-rc.10 before 5.0.0-rc.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
team-alembic ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.14 - Configuration
Relink each UserIdentity row's strategy in place to "<name>/<connection_id>" (rather than the bare strategy name) so the persisted __connection_id__ namespace is reflected in the identity lookup keys; ensure this runs in the same deployment as the upgrade and before users sign in to prevent collisions with surviving bare rows on the (uid, strategy) index.
team-alembic ash_authentication (dynamic_oidc / UserIdentity strategy relinking) UserIdentity.strategy = <name>/<connection_id> - Operational
In deployments with multiple dynamic_oidc connections, audit out of band before users sign in by exporting each connection's set of sub values from its identity provider and intersecting them.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the dynamic_oidc strategy with more than one identity-provider connection are exposed when identities from different connections can share the same subject (sub) value. The affected identity records are not separated by connection as intended.
What does an attacker need to exploit this?
The attacker must operate one identity-provider connection configured under a dynamic_oidc strategy. They can then be signed in as a local user whose identity was established through another connection because identity matching occurs before email checks and does not distinguish issuers.
How can I identify potentially affected identity records?
Inspect UserIdentity records for dynamic_oidc identities whose strategy value is the bare strategy name rather than a value formatted as "<name>/<connection_id>". A single record for the same uid and bare strategy can be used across connections because the unique key is (uid, strategy).
Do issuer values provide a safeguard against this issue?
No. Neither identity-handling strategy processes the iss claim, so the issuer does not provide an additional distinction between connections.