CVE-2026-91039

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

EUVD-2026-81687

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

CVE-2026-91039

team-alembic/ash_authentication versions 5.0.0-rc.10 through before 5.0.0-rc.14 are affected by an Authentication Bypass by Spoofing in the dynamic_oidc strategy. The __connection_id__ field is populated only on an ephemeral per-request struct, but DynamicOidc.IdentityChange.change/3 re-fetches t...

CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...