CVE-2026-82685: AshAuthentication Email Confirmation Token Vulnerability
Summary
CVE-2026-82685: Confirmation token accepted on any record in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 0.5.0, < 4.15.0
>= 1d4bb00617aecae85c33f2ff5bc7e094c6449a6e, < d7c15c21d39c009206e010cd67e2d86370fe7a28
< 2a2396af131ab67e2f445b805fecce8e6ca86c0e
>= 5.0.0-rc.0, < 5.0.0-rc.14
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is an open-source authentication library designed for Elixir applications, providing features such as user registration, login, and email confirmation. It allows developers to implement secure authentication mechanisms easily. However, a critical vulnerability has been identified that allows an attacker to exploit the email confirmation process, potentially leading to account takeovers.
Vulnerability Detail
The vulnerability stems from an Authorization Bypass Through User-Controlled Key in AshAuthentication. An authenticated attacker can overwrite and confirm another user's email address using a confirmation token issued to them. The flaw occurs because the token verification process does not adequately check the 'sub' claim against the targeted user's record. This allows an attacker to replay their confirmation token against a victim's record, effectively taking control of the victim's account after a password reset. The issue affects versions of ash_authentication from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.5.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate the ownership of the email confirmation token before applying any changes. This can be done by comparing the 'sub' claim in the token with the user record being modified.
Conclusion
CVE-2026-82685 represents a significant security risk for applications using the AshAuthentication library. It is crucial to update to the latest patched versions to mitigate the risk of account takeovers. Additionally, implementing temporary workarounds can help protect users until an update can be applied.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-82685 is a vulnerability in the AshAuthentication library that allows an attacker to take over another user's account by exploiting the email confirmation process.
The vulnerability affects ash_authentication versions from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot update the package immediately, implement additional validation checks to ensure that the email confirmation token is only applied to the correct user record.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
