Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80218— Sign-in token minted for one resource accepted by another in AshAuthentication

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： Team Alembic 的 AshAuthentication 中存在身份认证不当漏洞 Team Alembic 的 AshAuthentication 库中存在一个“身份认证不当”（Improper Authentication）漏洞。该漏洞允许攻击者持有一个针对某已认证资源的登录令牌（sign-in token），却能以此令牌登录为另一个不同资源的用户。 技术细节： 使用 解析 JWT 的 声明（例如 ），但仅保留其查询字符串部分，丢弃了标识令牌所签发对象（subject）的路径

CVSS 7.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80218

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sign-in token minted for one resource accepted by another in AshAuthentication
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected. This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 3.10.5 ~ 4.15.0 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication eca8cadea0f1595ed2c10a0c177b1da9aa9e5269 ~ * cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-80218

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80218

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80218 (2)

Vendor Advisories for CVE-2026-80218 (3)

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

CVE-2026-82761 9.1 CRITICAL Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533 9.1 CRITICAL Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-85500 9.1 CRITICAL `require_confirmed_with` is not enforced on the action and fails open on an unreadable att
CVE-2026-88952 9.1 CRITICAL OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-91039 9.1 CRITICAL dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c
CVE-2026-82760 8.2 HIGH Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
CVE-2026-82685 7.6 HIGH Confirmation token accepted on any record in AshAuthentication
CVE-2026-81632 7.2 HIGH Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223 6.9 MEDIUM Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522 6.3 MEDIUM Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-81637 2.3 LOW Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-82723 1.8 LOW Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759 1.8 LOW Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-287

V. Comments for CVE-2026-80218

No comments yet

Leave a comment