EEF-CVE-2026-85500
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-85500.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-85500.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-85500
- Aliases
-
- CVE-2026-85500
- GHSA-fc47-6pgw-wh22
- Published
- 2026-09-17T13:09:43Z
- Modified
- 2026-09-17T13:26:03Z
- Severity
-
- 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
- Details
-
Summary
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement.
AshAuthentication.Strategy.Password.Actions.check_user/2decides whether the attribute named byrequire_confirmed_withis set using a bareis_nil(Map.get(user, value)). When that attribute is not selected on the loaded recordMap.get/2returns%Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns%Ash.ForbiddenField{}. Neither isnil, so the rejection branch is skipped and sign-irequire_confirmed_withis enforced in two places, and neither holds in every configuration.sign_in_with_tokenandregisterare checked only insideAshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such asAshGraphqlorAshJsonApiinvokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute againstnil. That attribute holds%Ash.NotLoaded{}or%Ash.ForbiddenField{}when it setsselect_by_default?: false, when an API layer narrows the read'sselect, or when a field policy hides it from the sign-in actor. Neither struct isnil, so those configurations read every user as confirmed.This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
- Database specific
{ "capec_ids": [ "CAPEC-115" ], "cpe_ids": [ "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-305" ] }- References
-
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-fc47-6pgw-wh22
- https://cna.erlef.org/cves/CVE-2026-85500.html
- https://github.com/team-alembic/ash_authentication/commit/7d37bc6e4df6697b5813d2f373f0fdb08f813f98
- https://github.com/team-alembic/ash_authentication/commit/17f4c25a372d1778c9cc457759e6357570d83711
- https://github.com/team-alembic/ash_authentication/commit/1076639a9d40213088d110c79ba6735b8cc85b16
- https://hex.pm/packages/ash_authentication
- Credits
-
-
- Peter Ullrich - REPORTER
-
- Jonatan Männchen / EEF - ANALYST
-
- James Harton - REMEDIATION_DEVELOPER
-
Affected packages
Hex / ash_authentication
Package
- Name
- ash_authentication
- Purl
- pkg:hex/ash_authentication
Affected ranges
- Type
- SEMVER
- Events
-
Introduced4.3.8Fixed4.15.0
- Type
- SEMVER
- Events
-
Introduced5.0.0-rc.0Fixed5.0.0-rc.14