CVE-2026-85500

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...

CVE-2026-85500

This is an authentication bypass in AshAuthentication (team-alembic, Elixir), rated CVSS 9.1 CRITICAL . The require_confirmed_with check in check_user/2 uses is_nil(Map.get(user, value)); when the attribute is not selected or hidden by a field policy, Map.get/2 returns %Ash.NotLoaded{} or %Ash.Fo...