Vulnerability · Published Nov 3, 2026 · Assigned by EEF
CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
High 7.6
In plain English
A high-severity authorization bypass via user-controlled key in ash_authentication from team-alembic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| team-alembic | ash_authentication | 5.0.0-rc.0 – before 5.0.0-rc.16 |
| team-alembic | ash_authentication | 6e7a880698614887527a87df206b4eb0c0fbd8c1 – before 4058be0f519c2e9b0d2266e90f9c7d8547d54574 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- TOTP setup in AshAuthentication lets a user install their own authenticator secret on another user's account vendor-advisory, related
- EEF CNA record for CVE-2026-119215 related
- OSV record EEF-CVE-2026-119215 related
- Introducing commit 6e7a880 in team-alembic/ash_authentication related
- Fix commit 4058be0 in team-alembic/ash_authentication patch