CVE-2026-119215 Details
Description
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
A vulnerability allowing authorization bypass through user-controlled keys has been identified in the Team-Alembic Ash_Authentication library, specifically in versions 5.0.0-rc.0 prior to 5.0.0-rc.16. This vulnerability allows a user to install a TOTP secret they control onto another user's account. The issue arises because the `ConfirmSetupChange` action verifies the authenticity of a setup token without ensuring it was issued to the correct user record. As a result, an attacker can confirm their own pending TOTP secret onto a victim's account, enabling them to sign in as the victim or use their second factor for authentication.
The vulnerability has been fixed in Ash_Authentication version 5.0.0-rc.16. Users should update to this version. Applications that previously exposed TOTP setup actions directly should now use the `AshAuthentication.Strategy.Totp.Actions` module to ensure proper authorization is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-119215.html | EEF | AdvisoryBundleRemedy |
| https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-119215 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic ash_authentication | >= 5.0.0-rc.0, < 5.0.0-rc.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | EEF |