CVE-2026-88952: AshAuthentication OAuth2 Sign-In Vulnerability Allows Account Takeover
Summary
CVE-2026-88952: OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication. Affects ash_authentication across 5 version ranges.
< 2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba
>= 4.14.0, < 4.15.0
>= 5.0.0-rc.10, < 5.0.0-rc.14
>= 42edcd8ebb13fafbb168f12591d7518ce0611fec, < 738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459
>= 64530644f9b37ebb76ca14aeb83a77597a0034b7
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AshAuthentication is an open-source authentication library designed for Elixir applications, facilitating various authentication strategies, including OAuth2. It provides a framework for managing user identities and sessions securely. However, a flaw in its OAuth2 implementation allows attackers to link their verified provider accounts to existing user accounts without proper email verification, leading to potential account takeovers.
Vulnerability Detail
The vulnerability arises from an improper authentication mechanism in AshAuthentication's OAuth2 strategy. Specifically, the UserResolver.resolve/3 function matches existing accounts based on upsert_identity keys but fails to compare the provider's email with the matched account's email. This oversight allows an attacker to link their own verified email to another user's account, gaining unauthorized access. The attacker can then rewrite the victim's email address, redirecting account recovery processes to themselves. This vulnerability affects versions 4.14.0 to 4.15.0 and 5.0.0-rc.10 to 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.14.0, < 4.15.04.15.0 -
>= 5.0.0-rc.10, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, set the trust_email_verified? option to false in the affected OAuth2 strategy. This will prevent the linking of accounts based on email verification. You can do this by adding the following configuration to your strategy: trust_email_verified? false.
Conclusion
CVE-2026-88952 presents a significant security risk for users of AshAuthentication, allowing unauthorized account access through improper email verification during OAuth2 sign-in. It is crucial to upgrade to the patched versions and implement the recommended workarounds to mitigate this vulnerability.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-88952 is a vulnerability in the AshAuthentication library that allows attackers to link their OAuth2 accounts to existing user accounts without proper email verification.
Users can be signed in as other accounts without their consent, and their email addresses can be changed, leading to unauthorized access and account recovery issues.
The vulnerability affects AshAuthentication versions from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 9.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
