Description
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.

AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.

This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
Published: 2026-11-03
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: Authorization Bypass (Privilege Escalation)
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows a logged‑in user to install a TOTP secret they control on another user's account. The confirmation of a TOTP setup token is performed without verifying that the token belongs to the record being confirmed, enabling the attacker to confirm their own secret for someone else and then authenticate as that user or presentation the required second factor. This bypass constitutes an Authorization Bypass Through User‑Controlled Key flaw (CWE‑639).

Affected Systems

The issue affects the AshAuthentication library from team‑alembic. Versions from 5.0.0‑rc.0 through 5.0.0‑rc.15 are vulnerable; subsequent releases, starting with 5.0.0‑rc.16, contain the fix.

Risk and Exploitability

The CVSS score of 7.6 indicates high severity, and the absence of an EPSS score means exploitation probability is presently unknown. The flaw is not listed in CISA KEV, but it can be exploited by any authenticated user through exposed API endpoints that allow TOTP setup or confirmation on arbitrary user records. The attack does not require additional privileges and could lead to full account takeover, compromising confidentiality and integrity. If the application exposes the setup or confirm_setup actions via record keys, the vulnerability will be readily exploitable. Mitigation by applying the patch is strongly recommended given the potential impact.

Generated by OpenCVE AI on November 3, 2026 at 17:26 UTC.

Remediation

Vendor Workaround

Do not expose setup or confirm_setup on a record the caller chooses. Call them through AshAuthentication.Strategy.Totp.Actions with the signed-in user, as the built-in routes do.

OpenCVE Recommended Actions

  • Upgrade AshAuthentication to version 5.0.0‑rc.16 or later.
  • If an upgrade is not feasible, enforce a policy that limits TOTP setup and confirmation actions only to the authenticated user’s own record.
  • Reconfigure or remove any routes that expose the TOTP setup or confirm_setup actions directly by record key so that only the built‑in strategy actions can be used.

Generated by OpenCVE AI on November 3, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
Title AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-639
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-11-03T17:49:28.211Z

Reserved: 2026-11-03T03:30:01.648Z

Link: CVE-2026-119215

cve-icon Vulnrichment

Updated: 2026-11-03T17:49:23.196Z

cve-icon NVD

Status : Deferred

Published: 2026-11-03T16:17:21.683

Modified: 2026-11-03T18:17:55.197

Link: CVE-2026-119215

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T18:00:19Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key