ZeroDay Findings
Sign inSign up

Findings

CVE-2026-88952

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Published Sep 17, 2026 · corrected/updated Oct 13, 2026 · evidence confidence high

## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. matches an existing account using the register action's keys, then gates linking the incoming provider identity to it on , which reads only the provider's boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in on the path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner. This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14. ## Impact An attacker who controls a provider account with a verified email of their own is signed in as a different local user, holding a session bearing that user's subject, with no interaction from the victim and no need to pre-register. Because the link also rewrites the matched account's email to the attacker's address, account recovery for the victim is redirected to the attacker and the compromise survives the provider identity being unlinked. ## Workarounds Set on the affected strategy, which refuses the sign-in rather than linking it and closes both the register and the sign-in path. Alternatively, key the register action's , or the sign-in action's read filter, on the email attribute, which restores the premise the gate assumes. ## Configurations The strategy must have enabled, and the account must be matched on something other than the email: a register action whose keys are not the email attribute, or, with , a sign-in act

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-88952 is a unknown public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: ash_authentication (4.14.0 → 4.15.0). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: no CVSS/EPSS yet. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-287. Sources contributing to this record: cve_org, github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 17, 2026 · GitHub Advisory Database

    Detected

    ## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. matches an existing account using the register action's keys, then gates linking the incoming provider identity to it on , which reads only the provider's boolean and never compares the provider's email

  2. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 4.15.0

  3. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 4.15.0

  4. Oct 13, 2026 · GitHub Advisory Database

    Updated

    ## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. matches an existing account using the register action's keys, then gates linking the incoming provider identity to it on , which reads only the provider's boolean and never compares the provider's email

Affected

  • Hex ash_authentication4.14.0 → 4.15.0

Sources

References