CVE-2025-32782 Details

A vulnerability in the Ash Authentication library for the Ash framework allows for unintended account confirmations. The issue arises because the account creation confirmation process uses a GET request activated by clicking a link in a confirmation email. Some email clients and security tools, such as Outlook and various virus scanners, may automatically follow these links, thereby confirming the account without the user's knowledge. This flaw enables an attacker to register an account using someone else's email address, potentially leading to the account being confirmed by the victim's email client. However, this vulnerability does not allow access to existing accounts or private data, and only affects the confirmation of new accounts.

Users are advised to upgrade to Ash Authentication version 4.7.0 or later. If using Ash Authentication Phoenix, upgrade to version 2.6.0 or later. After upgrading, set 'require_interaction? true' in the confirmation strategy and add 'confirm_route' to the router, above 'auth_routes'.