CVE-2026-91039 team-alembic CVE debrief

Who should care

Defenders responsible for maintaining ash_authentication library versions should assess the exposure of their systems and verify the authenticity of user connections. This includes reviewing the library version used in their environment, identifying potential vulnerabilities, and implementing necessary updates or mitigations. Additionally, defenders should prioritize verifying user connection authenticity to prevent exploitation.

Why it matters

CVE-2026-91039 is a critical authentication bypass vulnerability in the ash_authentication library. Defenders should prioritize verifying user connection authenticity and assessing library version exposure to prevent exploitation.

• Authentication bypass allows unauthorized access to sensitive data
• Defenders must verify user connection authenticity to prevent exploitation
• System administrators should update ash_authentication to version 5.0.0-rc.14 or later

Technical summary

The vulnerability arises from a naming conflict in the dynamic_oidc strategy of the ash_authentication library. The strategy fails to properly namespace connections, allowing an attacker to sign in as a local user established through a different connection. This naming conflict stems from the strategy's failure to populate the __connection_id__ field in the UserIdentity row, leading to a shared subject space across different connections. As a result, an attacker can bypass authentication and gain unauthorized access to sensitive data.

Defensive priority

Defenders should prioritize verifying the authenticity of user connections and assessing the exposure of their ash_authentication library versions.

Recommended defensive actions

• Verify the authenticity of user connections
• Assess the exposure of ash_authentication library versions
• Update ash_authentication to version 5.0.0-rc.14 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability affects ash_authentication versions from 5.0.0-rc.10 before 5.0.0-rc.14. The issue arises from a naming conflict in the dynamic_oidc strategy, allowing an attacker to bypass authentication. The dynamic_oidc strategy fails to properly namespace connections, enabling an attacker to sign in as a local user established through a different connection. Evidence is based on the CVE record and NVD vulnerability detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.