The vulnerability in ash_authentication arises from improper authorization checks in the email confirmation token handling. Specifically, the ConfirmChange function verifies the token's signature and claims but does not ensure the token's subject (sub claim) matches the user record being modified. An attacker can register an account, change their own email to generate a confirmation token, then replay this token against another user's record ID. This causes the victim's email to be overwritten and confirmed with the attacker's address. Subsequently, the attacker can reset the victim's password and gain account control. The library's standard confirmation flow remains unaffected because it correctly resolves the subject claim to the user record. The affected versions are >=0.5.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14.

An authenticated attacker can take over another user's account by exploiting this vulnerability. They achieve this by overwriting and confirming the victim's email address with their own, then resetting the password to gain full access. This compromises account integrity and user data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid using affected versions or implement additional authorization checks to ensure the token's subject matches the targeted user record during email confirmation.