Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119215— AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 team-alembic 的 ash_authentication 库中存在一个“通过用户可控密钥绕过身份验证”的漏洞。该漏洞允许拥有账户的用户将自行控制的 TOTP（基于时间的一次性密码）密钥安装到另一个用户的账户上，随后以该用户身份登录，或劫持其第二因素认证。 具体而言， 虽然验证了设置令牌（setup token），但并未检查该令牌是否确实是颁发给当前正在被确认的记录。因此，攻击者可以将自己待处理的密钥确认并绑定到另一用户的记录上。此外，TOTP 设置相关的变更操作（包括 、 和 ）均将变更集标记为 交互

CVSS 7.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119215

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 5.0.0-rc.0 ~ 5.0.0-rc.16 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication 6e7a880698614887527a87df206b4eb0c0fbd8c1 ~ 4058be0f519c2e9b0d2266e90f9c7d8547d54574 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-119215

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119215

请登录查看更多情报信息。

Other References for CVE-2026-119215 (5)

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-639