CVE-2026-80218 Details
Description
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected. This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
A vulnerability in the AshAuthentication library by Team Alembic allows an attacker to use a sign-in token from one authenticated resource to gain access as a user on a different resource. This issue arises because the JWT 'sub' claim is improperly parsed, discarding the path that indicates the resource for which the token was originally issued. As a result, tokens can be accepted by resources that share a signing secret and have a matching primary key value. The vulnerability is present in AshAuthentication versions 3.10.5 prior to 4.15.0, and in the 5.0.0-rc.0 to 5.0.0-rc.14 range.
Users can upgrade to AshAuthentication version 4.15.0 or 5.0.0-rc.14, where this vulnerability has been fixed. For those unable to upgrade immediately, it is recommended to assign each authenticated resource its own signing secret, and to avoid using integer primary keys on authenticated resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-80218.html | EEF | AdvisoryBundle |
| https://github.com/team-alembic/ash_authentication/commit/2640e1872e1fef4e4606e601bf00102cff784c03 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/7baac243ca651eee127a84d672eee3fcff42e598 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3pr8-f99q-86hp | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-80218 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic AshAuthentication | >= 3.10.5, <= 4.14.2 (semver) >= 5.0.0-rc.0, <= 5.0.0-rc.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | EEF |