The vulnerability in ash_authentication's OAuth2 UserResolver component improperly authenticates users by linking an OAuth2 identity to an account without verifying that the provider's email matches the account's email. The gate that checks email trust relies solely on the email_verified flag from the OAuth2 provider, which is insufficient when the account is matched by attributes other than email. Consequently, an attacker with a verified email can be linked to another user's account and gain unauthorized access. Additionally, the matched account's email is overwritten with the attacker's email, enabling account recovery to be hijacked. This affects ash_authentication versions >=4.14.0 <4.15.0 and >=5.0.0-rc.10 <5.0.0-rc.14.

An attacker can impersonate another user by linking their own OAuth2 identity to that user's account, gaining unauthorized access and session issuance. The attacker can also overwrite the victim's email address, potentially hijacking account recovery processes. This compromises account integrity and confidentiality, posing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the input data. Users should monitor the vendor's announcements for updates and apply any official patches once available. Until then, consider disabling OAuth2 identity linking or restricting authentication flows that rely on unverified identity attributes.