EEF-CVE-2026-82685

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-82685.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-82685.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-82685

Aliases

CVE-2026-82685
GHSA-g636-26vf-2w63

Published

2026-09-17T13:08:56Z

Modified

2026-09-17T13:26:04Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Confirmation token accepted on any record in AshAuthentication

Details

Summary

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record.

AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.

This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Database specific

{
    "capec_ids": [
        "CAPEC-21"
    ],
    "cpe_ids": [
        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-639"
    ]
}

References

Credits

- Peter Ullrich - REPORTER
- James Harton - REMEDIATION_DEVELOPER
- Jonatan Männchen / EEF - ANALYST

Affected packages

Hex / ash_authentication

Package

Name: ash_authentication
Purl: pkg:hex/ash_authentication

Affected ranges

Type: SEMVER
Events: Introduced

0.5.0

Fixed

4.15.0

Type: SEMVER
Events: Introduced

5.0.0-rc.0

Fixed

5.0.0-rc.14

Affected versions

3.*

3.0.3

3.1.0

3.2.0

3.2.1

3.2.2

3.3.0

3.3.1

3.5.0

3.5.1

3.5.2

3.5.3

3.6.0

3.6.1

3.7.0

3.7.1

3.7.2

3.7.3

3.7.4

3.7.5

3.7.6

3.7.8

3.7.9

3.8.0

3.9.0

3.9.1

3.9.2

3.9.3

3.9.4

3.9.5

3.9.6

3.10.0

3.10.1

3.10.2

3.10.3

3.10.4

3.10.5

3.10.6

3.10.7

3.10.8

3.11.0

3.11.1

3.11.2

3.11.3

3.11.4

3.11.5

3.11.6

3.11.7

3.11.8

3.11.9

3.11.10

3.11.11

3.11.12

3.11.13

3.11.14

3.11.15

3.11.16

3.12.0

3.12.1

3.12.2

3.12.3

3.12.4

4.*

4.0.0-rc.0

4.0.0-rc.1

4.0.0-rc.2

4.0.0-rc.3

4.0.0-rc.5

4.0.0-rc.6

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.1.0

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.3.0

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.3.6

4.3.7

4.3.8

4.3.9

4.3.10

4.3.11

4.3.12

4.4.0

4.4.1

4.4.2

4.4.3

4.4.4

4.4.5

4.4.6

4.4.7

4.4.8

4.4.9

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

4.5.5

4.5.6

4.6.0

4.6.1

4.6.2

4.6.3

4.6.4

4.7.0

4.7.1

4.7.2

4.7.3

4.7.4

4.7.5

4.7.6

4.8.0

4.8.1

4.8.2

4.8.3

4.8.5

4.8.6

4.8.7

4.9.0

4.9.1

4.9.2

4.9.3

4.9.4

4.9.5

4.9.6

4.9.7

4.9.8

4.9.9

4.10.0

4.11.0

4.12.0

4.13.0

4.13.1

4.13.2

4.13.3

4.13.4

4.13.5

4.13.6

4.13.7

4.14.0

4.14.1

4.14.2

5.*

5.0.0-rc.0

5.0.0-rc.1

5.0.0-rc.2

5.0.0-rc.3

5.0.0-rc.4

5.0.0-rc.5

5.0.0-rc.6

5.0.0-rc.7

5.0.0-rc.8

5.0.0-rc.9

5.0.0-rc.10

5.0.0-rc.11

5.0.0-rc.12

5.0.0-rc.13

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-82685.json"

Git / github.com/team-alembic/ash_authentication

Affected ranges

Type: GIT
Repo: https://github.com/team-alembic/ash_authentication
Events: Introduced

1d4bb00617aecae85c33f2ff5bc7e094c6449a6e

Fixed

d7c15c21d39c009206e010cd67e2d86370fe7a28

Fixed

2a2396af131ab67e2f445b805fecce8e6ca86c0e

Affected versions

5.*

5.0.0-rc.8

5.0.0-rc.9

v0.*

v0.5.0

v0.6.0

v0.6.1

v1.*

v1.0.0

v2.*

v2.0.0

v2.0.1

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.0.4

v3.1.0

v3.10.0

v3.10.1

v3.10.2

v3.10.4

v3.10.5

v3.10.6

v3.10.7

v3.10.8

v3.11.0

v3.11.1

v3.11.10

v3.11.12

v3.11.13

v3.11.14

v3.11.15

v3.11.16

v3.11.2

v3.11.3

v3.11.4

v3.11.5

v3.11.6

v3.11.7

v3.11.8

v3.11.9

v3.12.0

v3.12.1

v3.12.2

v3.12.3

v3.12.4

v3.2.0

v3.2.1

v3.2.2

v3.3.0

v3.3.1

v3.4.0

v3.4.1

v3.4.2

v3.5.0

v3.5.1

v3.5.2

v3.5.3

v3.6.1

v3.7.0

v3.7.1

v3.7.2

v3.7.3

v3.7.4

v3.7.5

v3.7.6

v3.7.8

v3.7.9

v3.9.0

v3.9.2

v3.9.3

v3.9.4

v3.9.5

v3.9.6

v4.*

v4.0.0

v4.0.0-rc.0

v4.0.0-rc.1

v4.0.0-rc.2

v4.0.0-rc.3

v4.0.0-rc.4

v4.0.0-rc.5

v4.0.0-rc.6

v4.0.0-rc.7

v4.0.1

v4.0.2

v4.0.3

v4.0.4

v4.1.0

v4.10.0

v4.11.0

v4.12.0

v4.13.0

v4.13.1

v4.13.2

v4.13.3

v4.13.4

v4.13.5

v4.13.6

v4.13.7

v4.14.0

v4.14.1

v4.14.2

v4.2.0

v4.2.1

v4.2.2

v4.2.3

v4.2.5

v4.2.7

v4.3.0

v4.3.1

v4.3.10

v4.3.12

v4.3.2

v4.3.3

v4.3.4

v4.3.6

v4.3.7

v4.3.9

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.4.4

v4.4.5

v4.4.6

v4.4.7

v4.4.8

v4.4.9

v4.5.1

v4.5.2

v4.5.3

v4.5.4

v4.5.5

v4.5.6

v4.6.0

v4.6.1

v4.6.2

v4.6.3

v4.6.4

v4.7.0

v4.7.1

v4.7.2

v4.7.3

v4.7.4

v4.7.5

v4.7.6

v4.7.7

v4.8.0

v4.8.1

v4.8.2

v4.8.3

v4.8.4

v4.8.5

v4.8.7

v4.9.0

v4.9.1

v4.9.2

v4.9.3

v4.9.4

v4.9.5

v4.9.6

v4.9.7

v4.9.8

v4.9.9

v5.*

v5.0.0-rc.0

v5.0.0-rc.1

v5.0.0-rc.10

v5.0.0-rc.11

v5.0.0-rc.12

v5.0.0-rc.13

v5.0.0-rc.2

v5.0.0-rc.3

v5.0.0-rc.4

v5.0.0-rc.5

v5.0.0-rc.6

v5.0.0-rc.7

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-82685.json"