The vulnerability in ash_authentication stems from improper user identification during OAuth2/OIDC sign-in. Instead of using the OpenID Connect standard unique identifier (iss/sub claim), the system matched local users by email address, which can be spoofed or reused. This allowed attackers to bypass authentication by registering an OAuth provider account with a victim's email, including unverified emails, leading to full local account takeover. The fix changes the resolution logic to rely on the (strategy, sub) identity and conditionally link accounts by email only when the email_verified claim is trusted. Affected versions include 0.1.0 through before 4.14.0 and 5.0.0-rc.0 through before 5.0.0-rc.10.

An unauthenticated attacker can gain full control over a victim's local user account by exploiting the authentication bypass. This results in account takeover and potentially unauthorized access to all privileges associated with the victim's account. The vulnerability undermines the integrity of the authentication process in affected versions of ash_authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that changes user resolution to rely on the (strategy, sub) identity and only link accounts by email when the email_verified claim is trusted. Until an official fix is confirmed, users should monitor vendor communications for patches or updates addressing this issue.