CVE-2026-49757
OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Description
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers. A provider login presenting a victim's email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim's existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim's email (or who benefits from provider-side email reuse or reclamation) obtains the victim's full local privileges. The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider's email_verified claim is trusted (trust_email_verified?). This issue affects ash_authentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10.
INFO
Published Date :
June 15, 2026, 12:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Affected Products
The following products are affected by CVE-2026-49757
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | CRITICAL | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | CRITICAL | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update AshAuthentication to version 4.14.0 or later.
- Update AshAuthentication to version 5.0.0-rc.10 or later.
- Verify the trust_email_verified setting for providers.
- Review user identity linking logic.
Public PoC/Exploit Available at Github
CVE-2026-49757 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-49757.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-49757 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-49757
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-49757 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-49757 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: ash_authentication de team-alembic, Description: Una vulnerabilidad de omisión de autenticación por suplantación en team-alembic AshAuthentication permite la toma de control de cuentas de usuarios locales a través del inicio de sesión OAuth2/OIDC. Las estrategias de la familia OAuth2 y OIDC de AshAuthentication coincidían con el usuario local por dirección de correo electrónico (una operación de ’upsert’ en el campo de correo electrónico, o un filtro de inicio de sesión definido por el usuario) en lugar de por la combinación de reclamaciones iss/sub de OpenID Connect. Según OpenID Connect Core §5.7, solo iss/sub identifica de forma única y estable a un usuario final; otras reclamaciones, incluido el correo electrónico, NO DEBEN usarse como identificadores únicos. Un inicio de sesión de proveedor que presentaba el correo electrónico de una víctima, incluido un correo electrónico no verificado, un correo electrónico reutilizado o una cuenta con email_verified: false, se resolvió y se inició sesión como la cuenta local existente de la víctima. Un atacante no autenticado que puede registrar una cuenta en cualquier proveedor OAuth aceptado con el correo electrónico de la víctima (o que se beneficia de la reutilización o recuperación de correo electrónico por parte del proveedor) obtiene los privilegios locales completos de la víctima. La solución resuelve a los usuarios por la identidad (estrategia, sub) almacenada en un recurso de identidad de usuario, y solo vincula un nuevo sub a una cuenta local existente por correo electrónico cuando la reclamación email_verified del proveedor es de confianza (¿trust_email_verified?). Este problema afecta a ash_authentication desde 0.1.0 antes de 4.14.0 y desde 5.0.0-rc.0 antes de 5.0.0-rc.10. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/team-alembic/ash_authentication', 'vendor': 'team-alembic', 'modules': ["'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange'", "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation'"], 'product': 'ash_authentication', 'versions': [{'status': 'affected', 'version': '0.1.0', 'lessThan': '4.14.0', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.0.0-rc.0', 'lessThan': '5.0.0-rc.10', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/ash_authentication', 'packageName': 'ash_authentication', 'programFiles': ['lib/ash_authentication/strategies/oauth2/identity_change.ex', 'lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3"}, {'name': "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3"}]}, {'cpes': ['cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/team-alembic/ash_authentication.git', 'vendor': 'team-alembic', 'modules': ["'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange'", "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation'"], 'product': 'ash_authentication', 'versions': [{'status': 'affected', 'changes': [{'at': '728b8d28c1b5f465fa1116ef044a815300fc733d', 'status': 'unaffected'}, {'at': '64530644f9b37ebb76ca14aeb83a77597a0034b7', 'status': 'unaffected'}], 'version': 'c5f589058e04239263f50a1430eb17ea6d5dd1a2', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/team-alembic/ash_authentication', 'packageName': 'team-alembic/ash_authentication', 'programFiles': ['lib/ash_authentication/strategies/oauth2/identity_change.ex', 'lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3"}, {'name': "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3"}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-49757', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-15T12:35:13.009558Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 15, 2026
Action Type Old Value New Value Added Description Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers. A provider login presenting a victim's email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim's existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim's email (or who benefits from provider-side email reuse or reclamation) obtains the victim's full local privileges. The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider's email_verified claim is trusted (trust_email_verified?). This issue affects ash_authentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-290 Added Reference https://cna.erlef.org/cves/CVE-2026-49757.html Added Reference https://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14aeb83a77597a0034b7 Added Reference https://github.com/team-alembic/ash_authentication/commit/728b8d28c1b5f465fa1116ef044a815300fc733d Added Reference https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-777c-2fxx-qr28 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-49757