team-alembic ash_authentication up to 5.0.0-rc.13 Dynamic OIDC Strategy dynamic_oidc/plug.ex DynamicOidc.IdentityChange.change improper authentication

Summaryinfo

A vulnerability classified as critical has been found in team-alembic ash_authentication up to 5.0.0-rc.13. Affected by this issue is the function DynamicOidc.IdentityChange.change of the file dynamic_oidc/plug.ex of the component Dynamic OIDC Strategy. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-91039. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in team-alembic ash_authentication up to 5.0.0-rc.13 and classified as critical. This issue affects the function DynamicOidc.IdentityChange.change of the file dynamic_oidc/plug.ex of the component Dynamic OIDC Strategy. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "<name>/<connection_id>", but that namespacing never takes effect. __connection_id__ is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose __connection_id__ is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space. This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-91039 since 09/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 5.0.0-rc.14 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• team-alembic

Name

• ash_authentication

Version

• 5.0.0-rc.0
• 5.0.0-rc.1
• 5.0.0-rc.2
• 5.0.0-rc.3
• 5.0.0-rc.4
• 5.0.0-rc.5
• 5.0.0-rc.6
• 5.0.0-rc.7
• 5.0.0-rc.8
• 5.0.0-rc.9
• 5.0.0-rc.10
• 5.0.0-rc.11
• 5.0.0-rc.12
• 5.0.0-rc.13

Website

• Product: https://github.com/team-alembic/ash_authentication/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion