AshAuthentication incorrectly identifies local users by email address instead of the required issuer and subject combination, allowing an attacker who can create a new OAuth2/OIDC account with the victim's email to be signed in as that victim. This authentication bypass results in the attacker gaining full local privileges, effectively capturing the victim’s account and all data stored under it. The weakness aligns with CWE-290, which describes authentication mechanisms that rely on non‑unique or untrusted attributes.

The vulnerability affects AshAuthentication versions from the initial release 0.1.0 up to but not including 4.14.0, and from 5.0.0-rc.0 up to but not including 5.0.0-rc.10. The affected implementation is maintained by team‑alembic.

The CVSS score of 9.2 marks this flaw as critical. The EPSS score is not available, so the current probability of exploitation is unknown, but the flaw remains highlighted in security advisories without being listed in the CISA KEV catalog. Attackers can exploit the issue simply by registering an OAuth account with the victim’s email, a process that does not require privileged access to the target system. The attack vector is via legitimate OAuth2/OIDC sign‑in flows, making it potentially easy to execute by untrusted external actors.