The vulnerability in ash_authentication's OAuth2 callback handling is due to improper session expiration management. Specifically, the session_params used to protect against CSRF are deleted only on successful authentication. If the authentication fails or is cancelled, the session_params remain intact, allowing an attacker who has obtained the victim's OAuth2 state value to replay the callback and cause the victim to be signed into an attacker-controlled account. This flaw affects versions >=0.6.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14 of ash_authentication. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial attack and impact requirements, and low confidentiality and integrity impact.

An attacker who obtains a victim's OAuth2 state value can replay the callback to sign the victim into an attacker-controlled account. This could lead to session confusion or account misbinding but does not directly disclose sensitive information or allow privilege escalation. The overall impact is low severity as reflected by the CVSS score of 2.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a fix is available, avoid relying solely on the OAuth2 state value for session security and consider additional session management controls. Monitor vendor advisories for updates and apply patches once released.