CVE-2026-49757: OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Synopsis

Authentication bypass by spoofing in AshAuthentication (Elixir library by team-alembic) allows an unauthenticated attacker to take over any local user account via OAuth2 or OIDC sign-in. The vulnerability is reachable over the network with no authentication required and stems from the library matching incoming OAuth/OIDC logins to local accounts by email address rather than by the stable iss/sub claim pair mandated by OpenID Connect Core §5.7. Successful exploitation gives the attacker full access to the victim's local account, including all privileges, stored data, and any downstream resources tied to that identity. Patched-image rebuilds at versions 4.14.0 and 5.0.0-rc.10 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable OAuth2/OIDC callback endpoint is exposed over the network, so the attacker must be able to reach the service via standard HTTP/HTTPS.

• AuthenticationNot required

  No existing account or session on the target application is needed; the attacker initiates a fresh OAuth/OIDC sign-in flow as an anonymous user.

• Victim interactionNot required

  The victim does not need to take any action; the attacker completes the OAuth flow independently using an account they control on an accepted identity provider.

• Attack complexityDetail

  Base exploit complexity is low and condition-free, though the attack topology notes (AT:P) that the attacker must be able to register an account on an accepted OAuth provider using the victim's email address, or benefit from provider-side email reuse or reclamation.

Blast Radius

• The attacker signs in as the victim and inherits all of the victim's local application privileges, roles, and session rights.
• All data readable by the victim's account becomes directly accessible, including profile data, stored records, and any application secrets scoped to that user.
• The attacker can modify or delete any data the victim's account has write access to, including persisted rows, settings, and linked resources.
• The application service itself is subject to disruption if the attacker exercises destructive permissions held by the victim's account.