https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 04:54:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-49757 <p><strong>Affected:</strong> team-alembic ash_authentication</p> <p>Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in.</p> <p>AshAuthentication&#39;s OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers.</p> <p>A provider login presenting a victim&#39;s email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim&#39;s existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim&#39;s email (or who benefits from provider-side email reuse or reclamation) obtains the victim&#39;s full local privileges.</p> <p>The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider&#39;s email_verified claim is trusted (trust_email_verified?).</p> <p>This issue affects ash_authentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10.</p> <p><strong>Affected:</strong> team-alembic ash_authentication</p> <p>Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in.</p> <p>AshAuthentication&#39;s OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers.</p> <p>A provider login presenting a victim&#39;s email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim&#39;s existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim&#39;s email (or who benefits from provider-side email reuse or reclamation) obtains the victim&#39;s full local privileges.</p> <p>The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider&#39;s email_verified claim is trusted (trust_email_verified?).</p> <p>This issue affects ash_authentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10.</p> https://cve.radiocsirt.org/vuln/cve-2026-49757