Threat Intelligence Database

CVE-2026-65633 is an improper authentication vulnerability in the ash_authentication library by team-alembic. It allows purpose-limited JWT tokens, such as sign_in tokens, to be replayed as full bearer API credentials when stateless bearer-token verification is used without strict purpose checks. This bypasses intended one-time-use and revocation semantics, enabling an attacker with a valid sign_in token to authenticate as the token's subject. The issue affects versions from 3.10.5 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13. Resources configured with require_token_presence_for_authentication?: true or using session-based authentication are not affected.

CVE-2026-66882 is a reflected cross-site scripting (XSS) vulnerability in the team-alembic ash_authentication library. It occurs when certain parameters are embedded directly into HTML form inputs without proper escaping, allowing an attacker to inject malicious scripts. This affects the confirmation and magic link interaction forms when require_interaction? is set to true. An unauthenticated attacker can craft a URL that triggers script execution in the context of the vulnerable application, potentially exposing cookies and session data. The vulnerability affects ash_authentication versions from 4.8.0 up to but not including 4.14.2, and from 5.0.0-rc.0 up to but not including 5.0.0-rc.13. The CVSS 4.0 base score is 2.1, indicating low severity.

CVE-2026-49757 is a critical authentication bypass vulnerability in team-alembic's ash_authentication library affecting versions from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10. The flaw allows an attacker to take over local user accounts via OAuth2/OIDC sign-in by matching users based on email rather than the required unique OpenID Connect iss/sub claims. This enables an unauthenticated attacker who can register an OAuth provider account with a victim's email to impersonate that victim and gain their privileges. The issue arises because email addresses, including unverified or reused ones, were used as unique identifiers instead of the stable iss/sub combination. The fix involves resolving users by the (strategy, sub) identity and only linking by email if the email_verified claim is trusted.