The vulnerability in ash_authentication's AshAuthentication.Strategy.Password.Actions.check_user/2 function stems from improper handling of the require_confirmed_with attribute. When this attribute is not selected or is hidden due to field policies, the function receives %Ash.NotLoaded{} or %Ash.ForbiddenField{} structs instead of nil. Since the check only tests for nil, these cases bypass the confirmation requirement, allowing unconfirmed users to authenticate. Additionally, enforcement of require_confirmed_with is inconsistent, as some actions like sign_in_with_token and register only check within specific password strategy actions, not on the actions themselves. API layers such as AshGraphql or AshJsonApi invoke these actions directly, skipping the confirmation check entirely in default configurations. This leads to authentication bypass in affected versions.

An attacker can bypass the mandatory email confirmation step and obtain an authenticated session without confirming their email address. This undermines the intended security control designed to verify user identities before granting access, potentially allowing unauthorized access to protected resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or implement additional access controls to compensate for the bypass. Monitor vendor communications for patches or updates addressing this issue.