← Back to CVE Explorer

CVE-2026-119215

Full vulnerability record from the local CVENow database.

Description

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.

Severity
HIGH
CVSS score
7.6 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-11-03 16:17:21.683000
Last modified
2026-11-03 16:17:21.810000
View original CVE JSON 
{
  "id": "CVE-2026-119215",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-11-03T16:17:21.683",
  "lastModified": "2026-11-03T16:17:21.810",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "team-alembic",
          "product": "ash_authentication",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "ash_authentication",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange'",
            "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange'",
            "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange'"
          ],
          "programFiles": [
            "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange':change/3"
            },
            {
              "name": "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange':change/3"
            },
            {
              "name": "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange':change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "versions": [
            {
              "version": "5.0.0-rc.0",
              "lessThan": "5.0.0-rc.16",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "team-alembic",
          "product": "ash_authentication",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "team-alembic/ash_authentication",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange'",
            "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange'",
            "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange'"
          ],
          "programFiles": [
            "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange':change/3"
            },
            {
              "name": "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange':change/3"
            },
            {
              "name": "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange':change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "versions": [
            {
              "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1",
              "lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-119215.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}