Authentication Bypass Vulnerability in Team-Alembic Ash_Authentication
CVE-2026-91039

9.1CRITICAL

Key Information:

Vendor

Team-alembic

Status
Ash Authentication
Vendor
CVE Published:
17 September 2026

What is CVE-2026-91039?

An authentication bypass vulnerability in Team-Alembic's Ash_Authentication allows attackers who control one identity provider connection in a dynamic OIDC strategy to impersonate a local user from another connection. The intended separate identities for each connection fail due to inadequate namespacing, potentially leading to unauthorized access. Affected versions from 5.0.0-rc.10 before 5.0.0-rc.14 require immediate attention and remediation.

Affected Version(s)

ash_authentication 5.0.0-rc.10 < 5.0.0-rc.14

ash_authentication 64530644f9b37ebb76ca14aeb83a77597a0034b7 < 73ad16e452670bbf843550a13361bd41e72ad964

References

https://github.com/team-alembic/ash_authentication/securi...
relatedvendor-advisory
https://cna.erlef.org/cves/CVE-2026-91039.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-91039
related

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jace
Jonatan Männchen / EEF
manus-pi
James Harton
.