Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers. A provider login presenting a victim's email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim's existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim's email (or who benefits from provider-side email reuse or reclamation) obtains the victim's full local privileges. The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider's email_verified claim is trusted (trust_email_verified?). This issue affects ash_authentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-15 | 2 | Disclosure2 |
| 2026-06-16 | 1 | Active Exploitation1 |
It is possible to see elevated activities targeting team-alembic ash_authentication (CVE-2026-49757) https://vuldb.com/vuln/370892/cti
Post summary
The post indicates observed elevated activity targeting CVE-2026-49757, suggesting active exploitation, but offers no PoC, exploit code, patch, or technical details.
CVE-2026-49757 Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's… https://www.cve.org/CVERecord?id=CVE-2026-49757
Post summary
The text announces CVE‑2026‑49757, detailing an authentication bypass that permits account takeover of local users through OAuth2/OIDC sign‑in in AshAuthentication. No PoC, exploit, or patch information is provided.
CVE-2026-49757 Authentication Bypass in team-alembic AshAuthentication via OAuth2/OIDC Email Spoofing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49757
Post summary
This is a brief disclosure of CVE-2026-49757, an authentication bypass vulnerability in team-alembic's AshAuthentication module via OAuth2/OIDC email spoofing, with no PoC, exploit, patch, or active exploitation details provided.