CVE-2026-91039: Ash Authentication Cross-Connection Account Takeover Vulnerability
Summary
CVE-2026-91039: Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established t... Affects ash_authentication across 2 version ranges.
>= 5.0.0-rc.10, < 5.0.0-rc.14
>= 64530644f9b37ebb76ca14aeb83a77597a0034b7, < 73ad16e452670bbf843550a13361bd41e72ad964
Fixed in 5.0.0-rc.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ash Authentication is an open-source library designed for managing user authentication in Elixir applications. It provides a flexible framework for integrating various identity providers using strategies like dynamic OIDC. The library aims to ensure secure user identity management, but it has a critical vulnerability that allows for account takeover across different identity-provider connections.
Vulnerability Detail
The vulnerability arises from an authentication bypass by spoofing within the Ash Authentication library. Specifically, the dynamic_oidc strategy fails to properly namespace identities by connection, allowing an attacker to authenticate as a local user from a different connection. This occurs because the strategy's connection ID is not correctly utilized in the identity lookup process, leading to potential account takeovers. An attacker can exploit this flaw by obtaining or choosing their subject identifier (sub) on any connection, thereby gaining unauthorized access to another user's account without their knowledge. This issue affects versions 5.0.0-rc.10 to 5.0.0-rc.13 of the library.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0-rc.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds that fully mitigate the risk of this vulnerability. However, using a confirmation add-on can temporarily block account takeovers while the victim's account is unconfirmed. This is not a complete solution and should not be relied upon for long-term security.
Conclusion
CVE-2026-91039 represents a significant security risk for applications using the Ash Authentication library. It is crucial for developers to upgrade to the patched version and to audit their user identities to prevent potential account takeovers. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-91039 is a vulnerability in the Ash Authentication library that allows for cross-connection account takeover due to improper namespacing of identities.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
Versions 5.0.0-rc.10 to 5.0.0-rc.13 of Ash Authentication are affected by this vulnerability.
If immediate upgrading is not possible, consider implementing temporary measures such as using a confirmation add-on, but be aware that this does not fully resolve the issue.
The CVSS score for CVE-2026-91039 is 9.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
