CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...