CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver'",
      "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation'",
      "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange'",
      "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange'"
    ],
    "packageName": "ash_authentication",
    "packageURL": "pkg:hex/ash_authentication",
    "product": "ash_authentication",
    "programFiles": [
      "lib/ash_authentication/strategies/oauth2/user_resolver.ex",
      "lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex",
      "lib/ash_authentication/strategies/oauth2/identity_change.ex",
      "lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':resolve/3"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':email_trusted?/2"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange':change/3"
      }
    ],
    "repo": "https://github.com/team-alembic/ash_authentication",
    "vendor": "team-alembic",
    "versions": [
      {
        "lessThan": "4.15.0",
        "status": "affected",
        "version": "4.14.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.0.0-rc.14",
        "status": "affected",
        "version": "5.0.0-rc.10",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver'",
      "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation'",
      "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange'",
      "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange'"
    ],
    "packageName": "team-alembic/ash_authentication",
    "packageURL": "pkg:github/team-alembic/ash_authentication",
    "product": "ash_authentication",
    "programFiles": [
      "lib/ash_authentication/strategies/oauth2/user_resolver.ex",
      "lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex",
      "lib/ash_authentication/strategies/oauth2/identity_change.ex",
      "lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':resolve/3"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':email_trusted?/2"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3"
      },
      {
        "name": "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange':change/3"
      }
    ],
    "repo": "https://github.com/team-alembic/ash_authentication",
    "vendor": "team-alembic",
    "versions": [
      {
        "changes": [
          {
            "at": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
            "status": "unaffected"
          },
          {
            "at": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "64530644f9b37ebb76ca14aeb83a77597a0034b7",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
            "status": "unaffected"
          },
          {
            "at": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "42edcd8ebb13fafbb168f12591d7518ce0611fec",
        "versionType": "git"
      }
    ]
  }
]