6 matches found
CVE-2026-82685
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...
EUVD-2026-81479
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...
CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...
CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...
CVE-2026-82685
AshAuthentication (ash_authentication library by team-alembic) suffers from an Authorization Bypass Through User-Controlled Key in AddOn.Confirmation.ConfirmChange. The function verifies the token's signature and act claim but never compares the sub claim against changeset.data, so a confirmation...
CVE-2026-82685: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...