OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

{
  "id": "0f7b30b7ac0bd87bb5d4d0af065df28a63d61894270f061fdd914086ae97dede",
  "url": "https://osv.dev/vulnerability/EEF-CVE-2026-88952",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication",
    "summary": "## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. `AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3` matches an existing account using the register action's `upsert_identity` keys, then gates linking the incoming provider identity to it on `email_trusted?/2`, which reads only the provider's `email_verified` boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other `upsert_identity` it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in `OAuth2.SignInPreparation` on the `registration_enabled? false` path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner. This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14. ## Impact An attacker who controls a provider account with a verified email of their own is signed in as a different local user, holding a session bearing that user's subject, with no interaction from the victim and no need to pre-register. Because the link als",
    "evidence": "osv:EEF-CVE-2026-88952",
    "products": [
      {
        "name": {
          "value": "ash_authentication",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.15.0",
            "evidence": "/affected/0/ranges"
          },
          {
            "value": "5.0.0-rc.14",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "4.14.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "4.14.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "4.14.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "5.0.0-rc.10",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "5.0.0-rc.11",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "5.0.0-rc.12",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "5.0.0-rc.13",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "EEF-CVE-2026-88952",
      "aliases": [
        "CVE-2026-88952",
        "EEF-CVE-2026-88952",
        "GHSA-wc6x-276q-jrf9"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "4.14.0"
                },
                {
                  "fixed": "4.15.0"
                }
              ]
            },
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "5.0.0-rc.10"
                },
                {
                  "fixed": "5.0.0-rc.14"
                }
              ]
            }
          ],
          "package": {
            "name": "ash_authentication",
            "purl": "pkg:hex/ash_authentication",
            "ecosystem": "Hex"
          },
          "versions": [
            "4.14.0",
            "4.14.1",
            "4.14.2",
            "5.0.0-rc.10",
            "5.0.0-rc.11",
            "5.0.0-rc.12",
            "5.0.0-rc.13"
          ],
          "database_specific": {
            "source": "https://cna.erlef.org/osv/EEF-CVE-2026-88952.json"
          }
        },
        {
          "ranges": [
            {
              "repo": "https://github.com/team-alembic/ash_authentication",
              "type": "GIT",
              "events": [
                {
                  "introduced": "64530644f9b37ebb76ca14aeb83a77597a0034b7"
                },
                {
                  "fixed": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459"
                },
                {
                  "fixed": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba"
                }
              ]
            },
            {
              "repo": "https://github.com/team-alembic/ash_authentication",
              "type": "GIT",
              "events": [
                {
                  "introduced": "42edcd8ebb13fafbb168f12591d7518ce0611fec"
                },
                {
                  "fixed": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459"
                },
                {
                  "fixed": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba"
                }
              ]
            }
          ],
          "versions": [
            "v5.0.0-rc.13",
            "v5.0.0-rc.12",
            "v5.0.0-rc.11",
            "v5.0.0-rc.10"
          ],
          "database_specific": {
            "source": "https://cna.erlef.org/osv/EEF-CVE-2026-88952.json"
          }
        }
      ],
      "modified": "2026-10-13T08:00:03.799369851Z",
      "provider": "osv",
      "references": [
        "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wc6x-276q-jrf9",
        "https://cna.erlef.org/cves/CVE-2026-88952.html",
        "https://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14aeb83a77597a0034b7",
        "https://github.com/team-alembic/ash_authentication/commit/42edcd8ebb13fafbb168f12591d7518ce0611fec",
        "https://github.com/team-alembic/ash_authentication/commit/738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
        "https://github.com/team-alembic/ash_authentication/commit/2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
        "https://hex.pm/packages/ash_authentication"
      ],
      "provider_metadata": {
        "cpe_ids": [
          "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
        ],
        "cwe_ids": [
          "CWE-287"
        ],
        "capec_ids": [
          "CAPEC-115"
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-88952",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 307462,
  "published_at": "2026-09-17T14:15:19.506+00:00"
}