EEF-CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

🗓️ 17 Sep 2026 13:09:43Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Summary Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.che...

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-85500	17 Sep 202613:30	–	circl
CVE	CVE-2026-85500	17 Sep 202613:09	–	cve
Cvelist	CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication	17 Sep 202613:09	–	cvelist
EUVD	EUVD-2026-81487	17 Sep 202613:09	–	euvd
NVD	CVE-2026-85500	17 Sep 202614:17	–	nvd
Vulnrichment	CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication	17 Sep 202613:09	–	vulnrichment

Source	Link
github	www.github.com/team-alembic/ash_authentication/security/advisories/GHSA-fc47-6pgw-wh22
cna	www.cna.erlef.org/cves/CVE-2026-85500.html
github	www.github.com/team-alembic/ash_authentication/commit/7d37bc6e4df6697b5813d2f373f0fdb08f813f98
github	www.github.com/team-alembic/ash_authentication/commit/17f4c25a372d1778c9cc457759e6357570d83711
github	www.github.com/team-alembic/ash_authentication/commit/1076639a9d40213088d110c79ba6735b8cc85b16
hex	www.hex.pm/packages/ash_authentication

17 Sep 2026 13:26Current

CVSS 49.1