CVE-2026-49757: AshAuthentication OAuth2/OIDC Account Takeover via Email Matching
Summary
CVE-2026-49757: OAuth2/OIDC account takeover in AshAuthentication via email-based user matching. Affects ash_authentication across 4 version ranges.
>= 0.1.0, < 4.14.0
>= 5.0.0-rc.0, < 5.0.0-rc.10
< 64530644f9b37ebb76ca14aeb83a77597a0034b7
>= c5f589058e04239263f50a1430eb17ea6d5dd1a2, < 728b8d28c1b5f465fa1116ef044a815300fc733d
Fixed in 4.14.0 or 5.0.0-rc.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is an authentication library designed for use with the Elixir programming language, facilitating OAuth2 and OpenID Connect (OIDC) sign-in processes. It allows developers to integrate various authentication providers into their applications seamlessly. However, a critical vulnerability exists in its user matching mechanism, which relies on email addresses rather than the more secure OpenID Connect iss/sub claims, making it susceptible to account takeover attacks.
Vulnerability Detail
The vulnerability arises from an Authentication Bypass by Spoofing in AshAuthentication, where local users are matched based on their email addresses during OAuth2/OIDC sign-ins. This approach violates OpenID Connect specifications, which state that only the iss/sub claim combination should uniquely identify an end-user. An attacker can exploit this flaw by registering an account with any OAuth provider using a victim's email, potentially gaining full access to the victim's local account privileges, especially if the email is unverified or reused.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.1.0, < 4.14.04.14.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.105.0.0-rc.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional verification steps for email addresses during the registration process, such as requiring email verification before allowing OAuth sign-ins. This can help mitigate the risk of account takeover until the package is updated.
Conclusion
CVE-2026-49757 represents a significant security risk for applications using AshAuthentication due to its flawed email-based user matching during OAuth2/OIDC sign-ins. It is crucial for developers to update to the latest patched versions of the library and consider implementing additional security measures to protect user accounts.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-49757 is a vulnerability in the AshAuthentication library that allows attackers to take over user accounts via OAuth2/OIDC sign-ins by exploiting email-based user matching.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
If exploited, this vulnerability can allow an unauthenticated attacker to gain full access to a victim's local account, potentially compromising sensitive data and application integrity.
If an immediate update is not possible, implement email verification during the registration process to reduce the risk of account takeover until the vulnerability is patched.
The CVSS score for this vulnerability is 9.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
