The vulnerability in ash_authentication arises because OAuth2/OIDC strategies matched local users by email address instead of the OpenID Connect Core mandated unique identifier (iss/sub claim combination). Since email addresses can be unverified, reused, or reclaimed, an attacker registering an OAuth provider account with the victim's email can bypass authentication and assume the victim's local account privileges. The fix involves resolving users by the (strategy, sub) identity and only linking new subs to existing accounts when the provider's email_verified claim is trusted. This vulnerability affects ash_authentication versions =0.1.0, >=0.1.0 <4.14.0, and =5.0.0-rc.0 <5.0.0-rc.10.

An unauthenticated attacker can bypass authentication controls and take over local user accounts by exploiting the email-based user matching flaw in OAuth2/OIDC sign-in. This results in full local privileges being granted to the attacker, potentially compromising the affected system's security and user data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by changing user resolution to rely on the unique (strategy, sub) identity and verifying the email_verified claim before linking accounts. Until an official fix is confirmed, avoid relying on email-based user matching for OAuth2/OIDC authentication.