EEF-CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Summary Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each...

PT-2026-94373

Name of the Vulnerable Software and Affected Versions ash authentication versions 5.0.0-rc.10 through 5.0.0-rc.13 Description An authentication bypass by spoofing exists in the dynamic oidc strategy. This allows an attacker using one identity-provider connection to be signed in as a local user...