Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-65633— Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： --- 不当认证漏洞（Improper Authentication） 在 中，存在一个漏洞，允许将具有用途限制（purpose-limited）的 JWT 令牌在状态无感知（stateless）的 bearer-token 验证场景下被重放（replayed）为完整的 bearer API 凭据。 这个 bearer-token 认证助手会验证 JWT 的签名，并拒绝包含 声明的令牌，但它在 bearer 边界处并未检查令牌的 声明是否等于 。当资源配置为 （DSL 默认值）时，

CVSS 7.6 · High EPSS 0.36% · P29

Affected Version Matrix 3

VendorProduct Version RangeStatus
team-alembic ash_authentication 3.10.5< 4.14.2 affected
5.0.0-rc.0< 5.0.0-rc.13 affected
eca8cadea0f1595ed2c10a0c177b1da9aa9e5269< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-65633

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Purpose-limited JWT accepted as full bearer authentication in AshAuthentication
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrieve_from_bearer/3 verifies an Authorization: Bearer JWT's signature and rejects tokens containing an act claim, but performs no check that the token's purpose claim equals user at the bearer boundary. When the resource is configured with require_token_presence_for_authentication?: false (the DSL default), the follow-on validate_token/3 helper returns {:ok, nil} without consulting the token resource, so no downstream check on purpose takes place either. As a result, any valid, non-expired JWT the library itself issued for a narrow, single-purpose flow (most notably the purpose: sign_in token that WebAuthn always emits during sign-in, and that the Password strategy emits when sign-in tokens are enabled) is accepted directly as a general-purpose bearer credential and resolves to a full current_user assignment. This bypasses the library's intended token-exchange contract, in which the sign_in token is meant to be presented exactly once to a preparation that validates the purpose claim and immediately revokes the token. The first use of a still-valid sign-in token presented directly in the Authorization header succeeds because the stateless bearer path never scopes it to purpose == "user". An attacker who obtains a not-yet-exchanged sign-in token for a target subject (for example via log or referrer leakage, an intercepted magic-link delivery channel, or a partially compromised intermediary) can present it as a bearer token and be authenticated as that subject, fully bypassing the intended one-time-use and revocation semantics. Exploitation additionally requires that the host application wire up retrieve_from_bearer/3 on a reachable route and uses either WebAuthn (sign-in tokens are always issued) or the Password strategy with sign_in_tokens_enabled?: true. Resources configured with require_token_presence_for_authentication?: true (including applications scaffolded by the Igniter installer since v4.5.0) and the session-based path (authenticate_resource_from_session/4) enforce purpose == "user" against the stored token record and are not affected. This issue affects ash_authentication: from 3.10.5 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 3.10.5 ~ 4.14.2 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication eca8cadea0f1595ed2c10a0c177b1da9aa9e5269 ~ * cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-65633

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 15859 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-65633

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-65633 (2)

Vendor Advisories for CVE-2026-65633 (1)

Other References for CVE-2026-65633 (1)

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-287

V. Comments for CVE-2026-65633

No comments yet

Leave a comment