Authentication Flaw in Ash Framework by Alembic

CVE-2025-32782

What is CVE-2025-32782?

The Ash Authentication framework contains a vulnerability in its account creation process. The implementation employs a GET request triggered by a confirmation link sent via email. This behavior can be exploited by attackers, as some email clients and security tools may automatically follow such links, unintentionally confirming account creations. As a result, an attacker can register an account using another user's email address, which could lead to the victim's email client auto-confirming the new account. It’s important to note that this flaw is limited solely to the account confirmation of new accounts and does not grant access to existing accounts or private data. The issue has been addressed in version 4.7.0 of the product.

References