Authorization Bypass in AshAuthentication Affects User Account Security
CVE-2026-119215

7.6HIGH

Key Information:

Vendor

Team-alembic

Status
Ash Authentication
Vendor
CVE Published:
3 November 2026

What is CVE-2026-119215?

A critical vulnerability in AshAuthentication allows a malicious actor, equipped with an account, to install their own TOTP secret on another user's account. This manipulation enables the attacker to access the account by signing in as the targeted user or taking control of their second authentication factor. The flawed verification during the token setup process fails to validate whether the setup token was indeed issued for the designated account, which leads to unauthorized access. The issue affects specific versions across the product line, emphasizing the need for immediate attention and prompt updates to safeguard user accounts.

Affected Version(s)

ash_authentication 5.0.0-rc.0 < 5.0.0-rc.16

ash_authentication 6e7a880698614887527a87df206b4eb0c0fbd8c1 < 4058be0f519c2e9b0d2266e90f9c7d8547d54574

References

https://github.com/team-alembic/ash_authentication/securi...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-119215.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-119215
related

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

eliteaja11-dev
eliteaja11-dev
Zach Daniel / Ash Project
.