CVE-2026-88952

{
  "etk_id": "ETK-2026-3856",
  "cve_id": "CVE-2026-88952",
  "display_id": "CVE-2026-88952",
  "ghsa_id": "GHSA-wc6x-276q-jrf9",
  "euvd_id": "EUVD-2026-81619",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OAuth2 account-linking authentication bypass in ash_authentication",
  "summary": "ash_authentication can incorrectly link an OAuth2 identity to another user's account, allowing an attacker to sign in as that account and potentially alter its email address. This affects deployments using trusted provider email verification with a non-email registration identity or non-email sign-in filter; affected versions are 4.14.0 through 4.14.2 and 5.0.0-rc.10 through 5.0.0-rc.13.",
  "mitigation": "Upgrade to ash_authentication 4.15.0 or 5.0.0-rc.14, and configure `email_field` when the account email is not stored in `:email`. Until upgraded, disable trusted email verification or ensure registration and sign-in matching use the email attribute; review existing OAuth identity links and unexpected email changes.",
  "vendor": "erlang",
  "product": "ash_authentication",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.14.0, <= 4.14.2"
      ],
      "ecosystem": "erlang",
      "fixed_versions": [
        "4.15.0"
      ],
      "package_name": "ash_authentication",
      "purl": "pkg:hex/ash_authentication"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0-rc.10, <= 5.0.0-rc.13"
      ],
      "ecosystem": "erlang",
      "fixed_versions": [
        "5.0.0-rc.14"
      ],
      "package_name": "ash_authentication",
      "purl": "pkg:hex/ash_authentication"
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.0938473,
  "t0_at": "2026-09-17T14:15:19.506000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-17T14:15:19.506000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-17T14:15:19.506000+00:00",
      "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wc6x-276q-jrf9"
    }
  }
}