CVE-2026-117656

{
  "etk_id": "ETK-2026-3131",
  "cve_id": "CVE-2026-117656",
  "display_id": "CVE-2026-117656",
  "ghsa_id": "GHSA-9fr5-g44g-9526",
  "euvd_id": "EUVD-2026-114568",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Identity claim overwrite in pow-auth assent Apple sign-in",
  "summary": "pow-auth assent's Sign in with Apple strategy before 0.3.2 can treat browser-supplied callback identity data as authoritative. An unauthenticated attacker who can complete an Apple login may cause account impersonation where an application uses the returned subject or email for lookup, linking, or authorization; the application must have this strategy enabled and trust those returned values.",
  "mitigation": "Upgrade assent to version 0.3.2 or later. If pinning pow-auth/assent by source revision, update to 18898bde0296152165ae470078490e5798329b1b.",
  "vendor": "pow-auth",
  "product": "assent",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.1.25, < 0.3.2"
      ],
      "ecosystem": "erlang",
      "fixed_versions": [
        "0.3.2"
      ],
      "package_name": "assent",
      "purl": "pkg:hex/assent"
    }
  ],
  "cwes": [
    290
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 13.678330816666668,
  "t0_at": "2026-10-30T23:55:23.426000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-31T00:28:33.076224+00:00",
      "days": 0.023028359074074075,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T23:55:23.426000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-30T23:55:23.426000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T23:55:23.426000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117656"
    }
  }
}