Improper Authentication Flaw in AshAuthentication by Team Alembic

CVE-2026-88952

What is CVE-2026-88952?

The AshAuthentication component contains an improper authentication flaw that allows attackers to authenticate as another user by linking their OAuth2 identity to a victim's account. This vulnerability arises from the mismanagement of identity verification during the linking process, particularly in how the system incorrectly relies on the provider's email verification without cross-checking it against the user's account email. As a result, an attacker can utilize their own verified email to gain unauthorized access and potentially hijack the account, including altering recovery settings to redirect account control to themselves.

References