CVE-2026-88952 – OAuth2 Account Takeover / Authentication Bypass – AshAuthentication 4.14.0–4.15.0 a

Summary

CVE-2026-88952 is an improper authentication (CWE-287) vulnerability in AshAuthentication, the authentication extension for the Ash Framework (Elixir) maintained by team-alembic. The flaw resides in the OAuth2 strategy’s UserResolver.resolve/3 function, which links or matches an incoming OAuth2 identity to an existing user account based only on whether the identity provider reports the email as "verified" — without ever confirming that the provider’s email actually belongs to the account being matched. When an application upserts or signs in users on a non-email identity attribute (e.g., a username or external ID) with trust_email_verified? enabled, an attacker can use their own, legitimately verified OAuth account to take over any victim account matched by that attribute. NVD/vendor scoring rates this as critical (9.1) under certain configurations.

Technical details

• Root cause: AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 gates account linking/sign-in solely on the OAuth provider’s email_verified flag (email_trusted?/2), and never compares the provider-supplied email address against the email on the account it is matching or upserting.
• Trigger conditions: The target application configures trust_email_verified? true on an OAuth2/OIDC strategy and uses an upsert_identity (or sign-in read filter) keyed on an attribute other than email — for example, a username or an external identity field. This is notably easier to hit on the 5.0 pre-release line, whose OAuth generators expose a --identity-field option for configuring non-email upsert keys.
• Attack vector: Network-based, unauthenticated with respect to the victim — the attacker only needs their own valid, verified account with the OAuth/OIDC identity provider and no interaction from the victim is required.
• Impact: Full account takeover of victim accounts matched by the non-email attribute; the attacker’s sign-in flow can also overwrite the victim account’s stored email address, allowing the attacker to redirect password-reset flows to themselves. Malicious UserIdentity links created during exploitation persist even after the OAuth link is later removed or the application is patched, requiring manual cleanup.

Affected software

• AshAuthentication (team-alembic/ash_authentication) — Elixir package
  • Versions 4.14.0 up to (but not including) 4.15.0
  • Versions 5.0.0-rc.10 up to (but not including) 5.0.0-rc.14 (pre-release line)

Severity

• CVSS v4.0 Base Score: 9.1 (Critical) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
• The vendor advisory additionally scores the base flaw as CVSS v3.1: 7.4 (High) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N — escalating to 9.1 (Critical) in deployments where the OAuth/OIDC provider allows the attacker to influence the value used as the upsert identifier.

Mitigation and recommended actions

• Immediate: Upgrade AshAuthentication to 4.15.0 (4.x line) or 5.0.0-rc.14 (5.0 pre-release line), both of which contain the fix for UserResolver.resolve/3.
• If upgrading is not immediately possible:
  • Set trust_email_verified? false on any OAuth2/OIDC strategies until the upgrade is applied.
  • Ensure upsert_identity and sign-in read filters are configured to match on the email attribute rather than other identifiers.
• After upgrading:
  • Verify the email_field configuration matches your actual email attribute (default :email).
  • Audit existing UserIdentity records for provider emails that do not match the linked account’s email — these indicate potential prior exploitation.
  • Review any accounts with unexpected email changes as potentially compromised, since malicious identity links and email overwrites persist through the patch and require manual remediation.

References

• CVE-2026-88952 at NIST NVD
• GitHub Security Advisory GHSA-wc6x-276q-jrf9
• CVE Record (CVEProject/cvelistV5)