---
id: CVE-2026-82685
title: >-
  Authorization Bypass Through User-Controlled Key vulnerability in team-alembic
  AshAuthentication allows an authenticated attacker to overwrite and confirm
  another user's email address, and so take over that account
summary: >-
  Authorization Bypass Through User-Controlled Key vulnerability in team-alembic
  AshAuthentication allows an authenticated attacker to overwrite and confirm
  another user's email address, and so take over that account. A confirmation
  token …
severity: high
cvss: 7.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-639
vendor: team-alembic
product: ash_authentication
affected:
  - ash_authentication >= 0.5.0 < 4.15.0
  - ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.14
  - >-
    team-alembic/ash_authentication >= 1d4bb00617aecae85c33f2ff5bc7e094c6449a6e
    < *
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:16:18.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82685'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-82685.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/1d4bb00617aecae85c33f2ff5bc7e094c6449a6e
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/2a2396af131ab67e2f445b805fecce8e6ca86c0e
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/d7c15c21d39c009206e010cd67e2d86370fe7a28
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-g636-26vf-2w63
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-82685'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
tags:
  - nvd
  - cve.org
epss: 0.00665
epssPercentile: 0.49652
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T18:23:08.889793Z'
cvssSource: cna
ingestedAt: '2026-09-17T13:18:16.986Z'
---

## Overview

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record.

AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.

This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.