ash_authentication OAuth2 Account Takeover via Missing Email Verification (CVE-2026-48952)

Vulnerability Summary: Missing Email Consistency Check During OAuth2 Login Overview CVE ID: CVE-2026-48952 Severity: High (CVSS 7.4/10) Package: (Elixir) Core Issue: In the OAuth2 login flow, when is enabled, the system decides whether to bind the logging-in user to an existing account solely based on the provider's boolean value, without ever comparing whether the provider's email matches the email of the matched account. If the registrant's is not the email field, an attacker can log in with their own verified email and bind to another user's account, thereby taking over the account. Scope of Impact Affected Versions: and Fixed Versions: , Impact: - An attacker can take over an account without interacting with the victim or pre-registering (verified end-to-end using PostgREST). - When an attacker logs in via OAuth, points to the victim, and the upsert overwrites the email attribute in with the attacker's email; subsequent password reset emails are sent to the attacker, resulting in full account takeover. - In the sign-in path, uses as a double for the path, which exhibits the same defect and is more severe (the registration path falls back to the sign-in path upon refresh). - In the 5.0 line, the OAuth generator is generated by a supported command, and the option can be set to ; in the 4.x line, the OAuth generator is hand-written, and the resource must have an attribute, otherwise the comparison will error out. Remediation 1. Core Fix: Compare the provider's email with the matched account's email before binding, or restrict the branch to cases where is the email field. 2. Mitigations (if not upgrading): - Set to for the affected policies (the single change that closes both paths). - Change the registrant's key to the email attribute. 3. Notes: - If a resource stores the email in an attribute, the policy's must be set to that attribute, otherwise the comparison will error out. - Linked accounts are not overwritten, but an attacker may overwrite the account pointed to by . - When deploying OAuth policies that use a non-email , review the accounts pointed to by ; if the provider email does not match the linked account's email, treat it as the account's email having been unintentionally overwritten. POC / Exploitation Code The page does not contain a standalone POC code block, but describes the exploitation mechanism: An attacker logs in via OAuth, points to the victim, and the upsert overwrites the email attribute in with the attacker's email. Subsequent password reset emails are sent to the attacker, resulting in full account takeover.

Goal Reached Thanks to every supporter — we hit 100%!

ash_authentication OAuth2 Account Takeover via Missing Email Verification (CVE-2026-48952)

More from this source