ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-119215

AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Published Nov 3, 2026 · catalog updated Nov 3, 2026 · AshAuthentication TOTP setup lets

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119215. EPSS is 0.51%. Act only if a listed version of AshAuthentication TOTP setup lets is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (AshAuthentication TOTP setup lets).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.51%
Remediation
Advisory link
Affected products
Hex ash_authentication

## Summary Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, , and , also marked their changesets as AshAuthentication interactions, which the standard policy bypass lets through. A policy limiting and to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16. ## Workarounds Do not expose or on a record the caller chooses. Call them through with the signed-in user, as the built-in routes do. ## Configurations An application exposes the TOTP or action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to , and the attacker can read the victim's user record. Installing the attacker's secret requires ; signing in with it alone requires . The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex ash_authentication5.0.0-rc.0 → 5.0.0-rc.16

How to fix CVE-2026-119215

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119215. EPSS is 0.51%. Act only if a listed version of AshAuthentication TOTP setup lets is installed.

Which versions are affected?

Compare what you have installed with 5.0.0-rc.0 → 5.0.0-rc.16. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-639: Authorization Bypass Through User-Controlled Key. EPSS 0.51%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 3, 2026 · GitHub Advisory Database

    Detected

    ## Summary Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be c

  2. Nov 3, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 5.0.0-rc.16

  3. Nov 3, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 5.0.0-rc.16

  4. Nov 3, 2026 · GitHub Advisory Database

    Updated

    ## Summary Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be c

Sources

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseNov 5, 2026
  • OpenSSF OSV / OSV ScannerNov 5, 2026
  • CVE.orgNov 4, 2026