ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-88952

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Published Sep 17, 2026 · catalog updated Oct 13, 2026 · OAuth2 sign-in attached to

Check if you run it

No confirmed exploitation is on record for CVE-2026-88952. EPSS is 0.75%. Act only if a listed version of OAuth2 sign-in attached to is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (OAuth2 sign-in attached to).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.75%
Remediation
Advisory link
Affected products
Hex ash_authentication

## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. matches an existing account using the register action's keys, then gates linking the incoming provider identity to it on , which reads only the provider's boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in on the path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner. This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14. ## Impact An attacker who controls a provider account with a verified email of their own is signed in as a different local user, holding a session bearing that user's subject, with no interaction from the victim and no need to pre-register. Because the link also rewrites the matched account's email to the attacker's address, account recovery for the victim is redirected to the attacker and the compromise survives the provider identity being unlinked. ## Workarounds Set on the affected strategy, which refuses the sign-in rather than linking it and closes both the register and the sign-in path. Alternatively, key the register action's , or the sign-in action's read filter, on the email attribute, which restores the premise the gate assumes. ## Configurations The strategy must have enabled, and the account must be matched on something other than the email: a register action whose keys are not the email attribute, or, with , a sign-in act

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex ash_authentication4.14.0 → 4.15.0
  • Hex ash_authentication4.14.0 → 4.15.0; 5.0.0-rc.10 → 5.0.0-rc.14

How to fix CVE-2026-88952

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-88952. EPSS is 0.75%. Act only if a listed version of OAuth2 sign-in attached to is installed.

Which versions are affected?

Compare what you have installed with 4.14.0 → 4.15.0, 4.14.0 → 4.15.0; 5.0.0-rc.10 → 5.0.0-rc.14. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-287: Improper Authentication. EPSS 0.75%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 17, 2026 · GitHub Advisory Database

    Detected

    ## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. matches an existing account using the register action's keys, then gates linking the incoming provider identity to it on , which reads only the provider's boolean and never compares the provider's email

  2. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 4.15.0

  3. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 4.15.0

  4. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 4.15.0; ash_authentication fixed in 5.0.0-rc.14

  5. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 4.15.0; 5.0.0-rc.10

  6. Oct 13, 2026 · GitHub Advisory Database

    Updated

    ## Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. matches an existing account using the register action's keys, then gates linking the incoming provider identity to it on , which reads only the provider's boolean and never compares the provider's email

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.