Authentication Bypass Vulnerability in AshAuthentication by Team Alembic

CVE-2026-76949

What is CVE-2026-76949?

The AshAuthentication plugin from Team Alembic contains a vulnerability that allows attackers to bypass authentication through a spoofed 'remember-me' cookie. This flaw occurs because the login mechanism improperly handles authenticated sessions. An attacker can exploit this vulnerability by planting a malicious cookie in the victim’s browser, which causes the system to erroneously treat the attacker as an authenticated user. This enables the attacker to manipulate the victim's session, gaining control over sensitive data and operations. Specific versions of AshAuthentication from 4.10.0 up to, but not including, 4.15.0, and from 5.0.0-rc.0 to just before 5.0.0-rc.14 are affected. Users should review the provided references for patches and mitigation strategies.

References