Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-91039— dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Quick assessment

Affected

team-alembic ash_authentication

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

team-alembic 的 ash_authentication 中存在通过伪造进行身份认证绕过的漏洞。该漏洞允许控制动态 OIDC 策略中某个身份提供商连接的攻击者，冒充通过另一个连接建立的本地用户进行登录。该策略的设计初衷是通过将每一行记录中的字段写入为的形式，从而确保每个连接都拥有独立的身份命名空间。然而，这种命名空间机制实际上并未生效。仅在中为每个请求构建的临时运行时结构中被赋值，而会通过从编译时 DSL 重新获取策略，导致返回的是已持久化的结构体，其值仍为定义的默认值。因此，在写

CVSS 9.1 · Critical Updated Sep 17, 2026

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Source: CVE Program / CVE List V5

Vulnerability Description

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "<name>/<connection_id>", but that namespacing never takes effect. __connection_id__ is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose __connection_id__ is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space. This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用欺骗进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
team-alembic	ash_authentication	5.0.0-rc.10 ~ 5.0.0-rc.14	`cpe:2.3:a:team-alembic:ash_authentication::::::::`
team-alembic	ash_authentication	64530644f9b37ebb76ca14aeb83a77597a0034b7 ~ 73ad16e452670bbf843550a13361bd41e72ad964	`cpe:2.3:a:team-alembic:ash_authentication::::::::`

II. Public POCs for CVE-2026-91039

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-91039

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-91039 (3)

https://www.cve.org/CVERecord?id=CVE-2026-91039

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

CVE-2026-82761	9.1 CRITICAL	Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533	9.1 CRITICAL	Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-85500	9.1 CRITICAL	`require_confirmed_with` is not enforced on the action and fails open on an unreadable att
CVE-2026-88952	9.1 CRITICAL	OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-82760	8.2 HIGH	Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
CVE-2026-82685	7.6 HIGH	Confirmation token accepted on any record in AshAuthentication
CVE-2026-80218	7.6 HIGH	Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-81632	7.2 HIGH	Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223	6.9 MEDIUM	Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522	6.3 MEDIUM	Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-81637	2.3 LOW	Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-82723	1.8 LOW	Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759	1.8 LOW	Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication

Same vendor: team-alembic

Same weakness: CWE-290

V. Comments for CVE-2026-91039

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-91039— dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-91039

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-91039

III. Intelligence Information for CVE-2026-91039

Vendor Advisories for CVE-2026-91039 (3)

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-91039

Leave a comment