CVE-2026-119215highCWE-639

CVE-2026-119215: fallo de gravedad alta en team-alembic ash_authentication

AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Publicada el

Seguir esta CVE+ Monitorear ash authentication+ Monitorear ash_authentication

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.6epss 0.5%
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
team-alembic · ash_authentication
CVEs relacionadas — team-alembic ash_authentication

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-86533CRITICALRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEPSS 0.9%CVE-2026-76949CRITICALRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementEPSS 0.8%CVE-2026-85500CRITICAL`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationEPSS 0.8%CVE-2026-66882LOWReflected XSS in AshAuthentication confirmation and magic link interaction formsEPSS 0.8%CVE-2026-88952CRITICALOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationEPSS 0.7%CVE-2026-86688HIGHSession id is not renewed on authentication in ash_authentication, allowing session fixationEPSS 0.7%