CVE-2026-65633: CWE-287 Improper Authentication in team-alembic ash_authentication

The vulnerability arises because the AshAuthentication.Plug.Helpers.retrieve_from_bearer/3 function verifies JWT signatures and rejects tokens with an act claim but does not check that the token's purpose claim equals "user" at the bearer boundary. When the resource is configured with require_token_presence_for_authentication?: false (default), the validate_token/3 helper returns {:ok, nil} without consulting the token resource, so no downstream purpose check occurs. Consequently, any valid, non-expired JWT issued for a narrow purpose (e.g., sign_in tokens from WebAuthn or Password strategy) can be used directly as a general-purpose bearer token, granting full current_user authentication. This bypasses the intended token-exchange contract where sign_in tokens are single-use and revoked immediately after validation. Exploitation requires the attacker to obtain a not-yet-exchanged sign_in token and for the application to use retrieve_from_bearer/3 on a reachable route with WebAuthn or Password strategy with sign_in_tokens_enabled?: true. Applications enforcing require_token_presence_for_authentication?: true or using session-based authentication are not vulnerable.

An attacker who obtains a valid, not-yet-exchanged sign_in JWT token can replay it as a bearer token to authenticate as the token's subject, bypassing the intended one-time-use and revocation mechanisms. This allows unauthorized access to resources as the impersonated user. The vulnerability affects applications using stateless bearer-token verification with the vulnerable ash_authentication versions and specific configurations. Applications using session-based authentication or enforcing require_token_presence_for_authentication?: true are not impacted.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, applications should configure require_token_presence_for_authentication?: true to enforce purpose checks on tokens or use session-based authentication paths that validate token purpose. Avoid using retrieve_from_bearer/3 on reachable routes with WebAuthn or Password strategy sign_in tokens enabled unless the purpose claim is strictly verified. Monitor vendor advisories for updates and patches.