team-alembic ash_authentication up to 3.10.5/4.14.x/5.0.0-rc.0/5.0.0-rc.13 SignInWithTokenPreparation improper authentication

Summaryinfo

A vulnerability classified as critical has been found in team-alembic ash_authentication up to 3.10.5/4.14.x/5.0.0-rc.0/5.0.0-rc.13. The impacted element is the function AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject of the component SignInWithTokenPreparation. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2026-80218. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in team-alembic ash_authentication up to 3.10.5/4.14.x/5.0.0-rc.0/5.0.0-rc.13 and classified as critical. This issue affects the function AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject of the component SignInWithTokenPreparation. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected. This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-80218 since 09/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.15.0 or 5.0.0-rc.14 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• team-alembic

Name

• ash_authentication

Version

• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.10.4
• 3.10.5
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 5.0.0-rc
• 5.0.0-rc.0
• 5.0.0-rc.1
• 5.0.0-rc.2
• 5.0.0-rc.3
• 5.0.0-rc.4
• 5.0.0-rc.5
• 5.0.0-rc.6
• 5.0.0-rc.7
• 5.0.0-rc.8
• 5.0.0-rc.9
• 5.0.0-rc.10
• 5.0.0-rc.11
• 5.0.0-rc.12
• 5.0.0-rc.13

Website

• Product: https://github.com/team-alembic/ash_authentication/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion