Skip to content
Log inStart free trial

EEF-CVE-2026-80218 CVE-2026-80218 GHSA-3pr8-f99q-86hp

Sign-in token minted for one resource accepted by another in AshAuthentication

Not rated yet Hex
Severity
0.0 / 10
Unknown · CVSS 4.0
Exploit chance (EPSS)
0.64%
Chance of exploitation in the next 30 days. Higher than 50.53% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-287 Improper Authentication
Fix
5.0.0-rc.14
Upgrade ash_authentication to this version or later

Description

Summary

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.

AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.

This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Affected versions

Hex

PackageVulnerableFixed in
ash_authentication
>= 3.10.5, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
4.15.0
5.0.0-rc.14

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ash_authentication Hex → 5.0.0-rc.14

mix
{:ash_authentication, "~> 5.0.0-rc.14"} # then: mix deps.update ash_authentication

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it
  • Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
EEF-CVE-2026-86688
Session id is not renewed on authentication in ash_authentication, allowing session fixation
Not rated yet Also affects ash_authentication
EEF-CVE-2026-76949
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
Not rated yet Also affects ash_authentication
EEF-CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
Not rated yet Also affects ash_authentication
EEF-CVE-2026-88952
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
Not rated yet Also affects ash_authentication
EEF-CVE-2026-85500
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Not rated yet Also affects ash_authentication
EEF-CVE-2026-86533
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Not rated yet Also affects ash_authentication
EEF-CVE-2026-81632
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Not rated yet Also affects ash_authentication
EEF-CVE-2026-78223
Token revocation record built from unverified JWT claims in AshAuthentication
Not rated yet Also affects ash_authentication

Credits: James Harton, Jonatan Männchen / EEF, Peter Ullrich

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor