Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85500— `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 漏洞标题：通过主要缺陷实现的认证绕过漏洞 在 的 库中存在一个认证绕过漏洞，允许未确认的用户获取会话，从而绕过了强制要求的电子邮件确认机制。 函数通过 来判断由 指定的属性是否已设置。当加载的记录中未选择该属性时， 返回 ；当字段策略对当前操作者拒绝访问该字段时，返回 。由于这两个结构体都不等于 ，因此代码中的拒绝分支（rejection branch）被跳过，导致登录（sign-in）流程继续执行。 的检查在两个位置强制执行，但在某些配置下均不成立： 和 的检查仅存在于 内部，而

CVSS 9.1 · Critical

Possible ATT&CK Techniques 1 AI

T1556.001 · Domain Controller Authentication
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85500

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i require_confirmed_with is enforced in two places, and neither holds in every configuration. sign_in_with_token and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets select_by_default?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed. This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用基本弱点进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 4.3.8 ~ 4.15.0 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication 7d37bc6e4df6697b5813d2f373f0fdb08f813f98 ~ * cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-85500

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85500

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-85500 (1)

Vendor Advisories for CVE-2026-85500 (2)

Proof of Concept for CVE-2026-85500 (1)

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

CVE-2026-82761 9.1 CRITICAL Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533 9.1 CRITICAL Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-88952 9.1 CRITICAL OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-91039 9.1 CRITICAL dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c
CVE-2026-82760 8.2 HIGH Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
CVE-2026-82685 7.6 HIGH Confirmation token accepted on any record in AshAuthentication
CVE-2026-80218 7.6 HIGH Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-81632 7.2 HIGH Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223 6.9 MEDIUM Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522 6.3 MEDIUM Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-81637 2.3 LOW Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-82723 1.8 LOW Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759 1.8 LOW Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-305

V. Comments for CVE-2026-85500

No comments yet

Leave a comment