Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-82685— Confirmation token accepted on any record in AshAuthentication

Quick assessment

Affected

team-alembic ash_authentication

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

通过用户可控密钥绕过授权漏洞 Team Alembic 的库中存在一个通过用户可控密钥（User-Controlled Key）绕过授权的漏洞，使得经过认证的攻击者能够覆盖并确认其他用户的电子邮件地址，从而接管该用户的账户。具体表现为：为某一用户签发的确认令牌（confirmation token）会被接受并应用于任何其他用户的记录上。在验证时仅检查令牌的签名及其声明，然后将该令牌中存储的变更应用到变更集（changeset）所指向的记录，却未将声明与进行比对。因此，攻击者注册一个账户并修改自己的邮箱后，

CVSS 7.6 · High Updated Sep 17, 2026

Possible ATT&CK Techniques 1 AI

T1079.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Confirmation token accepted on any record in AshAuthentication

Source: CVE Program / CVE List V5

Vulnerability Description

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record. AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record. This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
team-alembic	ash_authentication	0.5.0 ~ 4.15.0	`cpe:2.3:a:team-alembic:ash_authentication::::::::`
team-alembic	ash_authentication	1d4bb00617aecae85c33f2ff5bc7e094c6449a6e ~ *	`cpe:2.3:a:team-alembic:ash_authentication::::::::`

II. Public POCs for CVE-2026-82685

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-82685

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82685 (2)

Vendor Advisories for CVE-2026-82685 (1)

🔗 Confirmation token is not bound to the record it confirms, and is not single-use in the generated action · Advisory · team-alembic/ash_authentication · GitHub Read full article related vendor-advisory

Other References for CVE-2026-82685 (2)

🔗 EEF-CVE-2026-82685 - OSV Read full article related
🔗 CVE-2026-82685 Read full article related

https://www.cve.org/CVERecord?id=CVE-2026-82685

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

CVE-2026-82761	9.1 CRITICAL	Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533	9.1 CRITICAL	Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-85500	9.1 CRITICAL	`require_confirmed_with` is not enforced on the action and fails open on an unreadable att
CVE-2026-88952	9.1 CRITICAL	OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-91039	9.1 CRITICAL	dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c
CVE-2026-82760	8.2 HIGH	Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
CVE-2026-80218	7.6 HIGH	Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-81632	7.2 HIGH	Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223	6.9 MEDIUM	Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522	6.3 MEDIUM	Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-81637	2.3 LOW	Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-82723	1.8 LOW	Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759	1.8 LOW	Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication

Same vendor: team-alembic

Same weakness: CWE-639

V. Comments for CVE-2026-82685

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-82685— Confirmation token accepted on any record in AshAuthentication

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-82685

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-82685

III. Intelligence Information for CVE-2026-82685

Patches & Fixes for CVE-2026-82685 (2)

Vendor Advisories for CVE-2026-82685 (1)

Other References for CVE-2026-82685 (2)

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-82685

Leave a comment