{"id":"CVE-2026-80218","aliases":["GHSA-3pr8-f99q-86hp"],"url":"https://o3.security/vulnerability/CVE-2026-80218","summary":"Sign-in token minted for one resource accepted by another in AshAuthentication","details":"## Summary\n\nImproper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource.\n\n`AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2` parses the JWT `sub` claim (for example `user?id=1`) with `URI.parse/1` and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: `AshAuthentication.Jwt.verify/3` checks the signature, `exp`, `nbf`, `jti` and the library-version claims, the purpose check only requires `sign_in`, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected.\n\nThis issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","published":"2026-09-17T13:09:25.585Z","modified":"2026-09-17T13:26:03.729128908Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Hex","name":"ash_authentication","fixedVersion":"4.15.0"}],"fix":{"url":"https://github.com/team-alembic/ash_authentication/commit/2640e1872e1fef4e4606e601bf00102cff784c03","label":"team-alembic/ash_authentication@2640e18"},"references":[{"type":"ADVISORY","url":"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3pr8-f99q-86hp"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-80218.html"},{"type":"WEB","url":"https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269"},{"type":"FIX","url":"https://github.com/team-alembic/ash_authentication/commit/2640e1872e1fef4e4606e601bf00102cff784c03"},{"type":"FIX","url":"https://github.com/team-alembic/ash_authentication/commit/7baac243ca651eee127a84d672eee3fcff42e598"},{"type":"PACKAGE","url":"https://hex.pm/packages/ash_authentication"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T13:26:03.729128908Z"}}