CVE-2026-91039

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-91039

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91039.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-91039

Aliases

EEF-CVE-2026-91039
GHSA-73j9-m294-fvv9

Published

2026-09-17T15:19:15Z

Modified

2026-09-20T11:30:34Z

Severity

9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Details

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection.

The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "/<connection_id>", but that namespacing never takes effect. connection_id is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose connection_id is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space.

This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.

Database specific

{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-290"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91039.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "64530644f9b37ebb76ca14aeb83a77597a0034b7"
                },
                {
                    "fixed": "73ad16e452670bbf843550a13361bd41e72ad964"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/team-alembic/ash_authentication

Affected ranges

Type

GIT

Repo

https://github.com/team-alembic/ash_authentication

Events

Introduced

8fa0d9823fbef04aaab517e7ea0f4b17976f1502

Fixed

fea75958a081ed337ceb578396174039694c48df

Fixed

64530644f9b37ebb76ca14aeb83a77597a0034b7

Fixed

73ad16e452670bbf843550a13361bd41e72ad964

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "5.0.0-rc.10"
        },
        {
            "fixed": "5.0.0-rc.14"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v5.*

v5.0.0-rc.10

v5.0.0-rc.11

v5.0.0-rc.12

v5.0.0-rc.13

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91039.json"