The vulnerability allows a purpose‑limited JSON Web Token that is intended to be used only once, such as a sign‑in token, to be used as a full bearer credential. An attacker who obtains a valid, non‑expired sign‑in token can present it in the Authorization header and be authenticated as the token’s subject. This bypasses the one‑time use and revocation model that the library enforces for sign‑in tokens, resulting in unauthorized access to the target account. The weakness is a failure to verify the token’s purpose claim when performing stateless bearer‑token authentication, leading to a CWE‑287 authentication bypass.

The issue affects the AshAuthentication library provided by team‑alembic. Vulnerable releases include all versions from 3.10.5 up to but not including 4.14.2, and from 5.0.0‑rc.0 up to but not including 5.0.0‑rc.13. Applications that have integrated a stateless bearer‑token helper without enforcing the required_token_presence_for_authentication? option and that enable WebAuthn or the Password strategy with sign‑in tokens enabled are most susceptible.

The CVSS score of 7.6 reflects considerable risk, with the EPSS score unavailable but no data suggesting a lack of exploitation potential. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to acquire a still‑valid sign‑in token, which can occur through log or referrer leaks, intercepted magic‑link channels, or a partially compromised intermediary. Once obtained, the attacker can simply send the token in an Authorization header on any reachable route that uses the build‑in bearer retrieval helper. The library’s default configuration (require_token_presence_for_authentication?: false) allows this misuse, while configurations that enable the token presence check and session‑based paths remain safe.