CVE-2026-85500: AshAuthentication Authentication Bypass Vulnerability
Summary
CVE-2026-85500: Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. Affects ash_authentication across 4 version ranges.
>= 4.3.8, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
>= 7d37bc6e4df6697b5813d2f373f0fdb08f813f98, < 17f4c25a372d1778c9cc457759e6357570d83711
< 1076639a9d40213088d110c79ba6735b8cc85b16
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is a package designed for user authentication in applications built with the Ash framework. It provides functionalities such as user registration, login, and session management, ensuring secure access to applications. However, it has a critical vulnerability that allows unconfirmed users to bypass mandatory email confirmation, potentially leading to unauthorized access.
Vulnerability Detail
The vulnerability arises from the require_confirmed_with attribute not being properly enforced in the AshAuthentication package. Specifically, the method AshAuthentication.Strategy.Password.Actions.check_user/2 fails to correctly handle cases where the confirmation attribute is unreadable or not loaded, allowing unconfirmed users to obtain a session. This flaw can lead to unauthorized access, as the system incorrectly treats all users as confirmed, especially when certain configurations are applied. The vulnerability affects versions of ash_authentication from 4.3.8 to 4.15.0 and from 5.0.0-rc.0 to 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.3.8, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the require_confirmed_with attribute is explicitly checked in your application logic before allowing users to sign in. You can implement a manual check in your sign-in logic to verify that users are confirmed before granting access.
Conclusion
CVE-2026-85500 represents a significant security risk for applications using the AshAuthentication package. It is crucial to update to the latest patched version to mitigate this vulnerability and ensure that only confirmed users can access the system.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-85500 is a vulnerability in the AshAuthentication package that allows unconfirmed users to bypass email confirmation and gain unauthorized access.
The vulnerability affects ash_authentication versions from 4.3.8 to 4.15.0 and from 5.0.0-rc.0 to 5.0.0-rc.14.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 9.1, indicating a high severity level.
If immediate updating is not possible, implement a manual check in your sign-in logic to ensure that only confirmed users can access the application.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
