CVE-2026-88952 team-alembic CVE debrief

Who should care

Defenders responsible for ash_authentication deployments should assess exposure and prioritize verification and remediation. They must verify and upgrade to affected ash_authentication versions, assess exposure, and implement compensating controls. Security teams and vulnerability management teams should also review the vulnerability and its potential impact on their systems.

Why it matters

CVE-2026-88952 is a critical Improper Authentication vulnerability in team-alembic AshAuthentication that allows an attacker to be signed in as another user. Defenders should prioritize verifying and upgrading to affected versions, assessing exposure, and implementing compensating controls.

• An attacker can be signed in as another user
• Account recovery reaches the attacker rather than the owner
• Defenders must verify and upgrade to affected ash_authentication versions

Technical summary

The AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 function improperly authenticates users, allowing an attacker to link an OAuth2 identity to an account that is not theirs. This occurs because the function matches an existing account using the register action's upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2. The gate only reads the provider's email_verified boolean and never compares the provider's email value with the matched account's email, leading to potential authentication bypass.

Defensive priority

Defenders should prioritize verifying and upgrading to affected ash_authentication versions, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify and upgrade to affected ash_authentication versions
• Assess exposure and implement compensating controls
• Monitor for suspicious activity
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source references provide details on the vulnerability, including affected versions 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14, and potential impact. Defenders should verify and upgrade to affected ash_authentication versions, assess exposure, and implement compensating controls. The CVE Program record and NVD detail page offer official information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.