An authenticated attacker can supply a confirmation token that was issued to a different user and have the system apply the token’s changes to that user’s account. Because the library does not verify that the token’s subject matches the target record, an attacker can rewrite another person’s email address and set the confirmed flag, effectively taking control of the victim’s account. This is a classic authorization bypass identified as CWE‑639, where the system incorrectly accepts a user‑controlled key—here, the confirmation token—as valid for any account.

The vulnerability affects Team Alembic’s AshAuthentication library. All releases from 0.5.0 up to, but not including, 4.15.0 and from 5.0.0‑rc.0 up to, but not including, 5.0.0‑rc.14 are impacted.

The CVSS score is 7.6, indicating a high severity. The EPSS metric is currently unavailable, but the lack of a KEV listing suggests limited public exploitation at this time. The likely attack vector is a remote, authenticated user who has a legitimate account and can initiate an email change. The attacker generates a confirmation token for their own account and replays it against another user’s record, forcing a change that can be followed by a standard password reset to gain complete control. This exploitation path requires only the ability to create an account and request an email change, making the threat significant for any deployment of the affected library.