Description
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.

AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.

This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Published: 2026-09-17
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: Authentication Bypass
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an attacker who possesses a valid sign‑in token issued for one resource to authenticate as a user of a different resource, because the token’s subject claim is parsed in a way that discards the resource path. This results in improper authentication and enables cross‑resource impersonation. The flaw aligns with CWE‑287, which describes failures in authentication mechanisms.

Affected Systems

The issue affects the team‑alembic AshAuthentication library. Versions from 3.10.5 up to (but not including) 4.15.0 and from 5.0.0‑rc.0 up to (but not including) 5.0.0‑rc.14 are vulnerable.

Risk and Exploitability

The CVSS score of 7.6 indicates a high severity. The EPSS score is not available, so the current exploit probability cannot be quantified, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, where an adversary can obtain or forge a JWT token for a user on one resource and then use that token to authenticate to another resource subject to the library’s improper binding logic. The risk is that an attacker could gain unauthorized access to resources and potentially data that belong to the impersonated user. The impact is significant for any system that relies on AshAuthentication for access control.

Generated by OpenCVE AI on September 17, 2026 at 22:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AshAuthentication to a patched release (>= 4.15.0 or >= 5.0.0-rc.14).
  • Ensure the application uses the updated token validation code that preserves the resource path when parsing the JWT sub claim.
  • Add an application‑level check that the token’s subject matches the intended resource, rejecting tokens that do not belong to that resource.
  • Monitor authentication logs for anomalous cross‑resource sign‑in attempts and investigate any suspicious activity.

Generated by OpenCVE AI on September 17, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected. This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Title Sign-in token minted for one resource accepted by another in AshAuthentication
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-287
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-17T18:28:47.571Z

Reserved: 2026-09-11T18:30:01.333Z

Link: CVE-2026-80218

cve-icon Vulnrichment

Updated: 2026-09-17T18:28:45.145Z

cve-icon NVD

Status : Received

Published: 2026-09-17T14:17:30.743

Modified: 2026-09-17T19:17:03.287

Link: CVE-2026-80218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T22:30:17Z

Weaknesses