Description
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement.

AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i

require_confirmed_with is enforced in two places, and neither holds in every configuration. sign_in_with_token and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets select_by_default?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed.

This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Published: 2026-09-17
Score: 9.1 Critical
EPSS: n/a
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in AshAuthentication allows an unconfirmed user to obtain a session, bypassing the mandatory email confirmation requirement, due to an improper enforcement of the require_confirmed_with attribute. This is a typical authentication bypass identified as CWE-305 and results in unauthorized access.

Affected Systems

Affected is the AshAuthentication library from team-alembic. Versions from 4.3.8 up to (but not including) 4.15.0 and 5.0.0-rc.0 up to (but not including) 5.0.0-rc.14 are vulnerable.

Risk and Exploitability

The CVSS score of 9.1 indicates high severity. No EPSS data is provided, but the vulnerability can be exploited via API calls that invoke the action directly (e.g., through AshGraphql or AshJsonApi). The KEV status is not listed, so no known exploitation campaign is reported. Attackers with access to the API can bypass email confirmation, sign in, and gain unauthorized sessions.

Generated by OpenCVE AI on September 17, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AshAuthentication to version 4.15.0 or later (or 5.0.0-rc.14 or later) to apply the fix that enforces require_confirmed_with on all actions.
  • Verify the resource definition sets require_confirmed_with to the confirmation attribute and that field policies properly restrict access to unconfirmed users.
  • If upgrading is not immediately possible, restrict API access so that the action checks are enforced (e.g., configure AshGraphql or AshJsonApi to route through the action with policy enforcement).

Generated by OpenCVE AI on September 17, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i require_confirmed_with is enforced in two places, and neither holds in every configuration. sign_in_with_token and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets select_by_default?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed. This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Title `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-305
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-17T18:12:54.127Z

Reserved: 2026-09-07T23:45:01.895Z

Link: CVE-2026-85500

cve-icon Vulnrichment

Updated: 2026-09-17T18:12:11.379Z

cve-icon NVD

Status : Received

Published: 2026-09-17T14:17:46.050

Modified: 2026-09-17T19:17:05.520

Link: CVE-2026-85500

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T00:00:12Z

Weaknesses
  • CWE-305

    Authentication Bypass by Primary Weakness