CVE-2026-119215

HighCVSS 7.6/10Last modified Nov 3, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.

AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.

This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.

Metrics

CVSS 4.0 7.6/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
team-alembic	ash_authentication	>= 5.0.0-rc.0, < 5.0.0-rc.16
team-alembic	ash_authentication	>= 6e7a880698614887527a87df206b4eb0c0fbd8c1, < 4058be0f519c2e9b0d2266e90f9c7d8547d54574

References

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1192185.4The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url CVE-2026-1192195.4The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[<custom_meta_field_id>]' parameter in a CVE-2026-119226.5A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and CVE-2026-119237.4IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container CVE-2026-119233proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a CVE-2026-119234mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buf CVE-2026-119235proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been CVE-2026-119236An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already mo CVE-2026-119237In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding fo CVE-2026-1192383.3A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthor CVE-2026-1192497.5A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to CVE-2026-119252.7Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.