The vulnerability in ash_authentication's AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 function stems from improper parsing of the JWT 'sub' claim. The function uses URI.parse/1 and retains only the query string, discarding the path segment that specifies the resource subject. Consequently, the binding between the token and the intended resource is lost. Verification checks do not restore this binding, as they only validate signature, expiration, and other claims, and compare primary key field names that are identical across resources. This allows an attacker with a valid token for one resource to authenticate as a user of another resource. The WebAuthn and remember-me sign-in preparations share this flawed helper, while the magic link sign-in path is unaffected due to explicit subject name pinning.

An attacker holding a valid sign-in token for one resource can impersonate a user of a different resource, bypassing intended authentication boundaries. This could lead to unauthorized access to resources and potential privilege escalation within affected deployments of ash_authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or apply any vendor-provided workarounds if available. Monitor vendor channels for updates addressing this improper authentication vulnerability.