Critical · CVSS 9.1CVE-2026-91039

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverCVE-2026-91039

Answer in brief

CVE-2026-91039 records a Critical severity (CVSS 9.1) vulnerability in dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover. The current sources do not mark it as known exploited. The current feed maps team-alembic/ash_authentication (generic), team-alembic/ash_authentication (generic), team-alembic/team-alembic/ash_authentication (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 18, 2026Source checked Nov 1, 2026First seen by HOL Sep 17, 2026Material review Sep 18, 2026

Upstream Advisory

Affected scope and exposure questions

The current feed maps team-alembic/ash_authentication (generic), team-alembic/ash_authentication (generic), team-alembic/team-alembic/ash_authentication (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
team-alembic/ash_authenticationgeneric	>=5.0.0-rc.10 <5.0.0-rc.14	5.0.0-rc.14
team-alembic/ash_authenticationgeneric	>=64530644f9b37ebb76ca14aeb83a77597a0034b7 <73ad16e452670bbf843550a13361bd41e72ad964	73ad16e452670bbf843550a13361bd41e72ad964
team-alembic/team-alembic/ash_authenticationgeneric	>=64530644f9b37ebb76ca14aeb83a77597a0034b7 <73ad16e452670bbf843550a13361bd41e72ad964	73ad16e452670bbf843550a13361bd41e72ad964

Recommended response

Check inventory. Check lockfiles and deployed manifests for team-alembic/ash_authentication, team-alembic/ash_authentication, team-alembic/team-alembic/ash_authentication.

Review the reported fix. Source-reported solution: Upgrading is not sufficient on its own, for two reasons. Namespacing changes the value the identity lookup keys on, so UserIdentity rows written before the fix, all holding the bare strategy name, no longer match. Each row's strategy must be relinked in place to "<name>/<connection_id>". Deleting the rows does not work: the block is the account match that follows, refused under the default on_untrusted_email_match :reject whether the row exists or not, and deleting also discards the stored refresh token. Where a deployment has one connection the mapping is unambiguous and the update is mechanical, but it must run in the same deployment as the upgrade and before users sign in, or a newly written namespaced row can collide with a surviving bare row on the (uid, strategy) index. The fix also cannot separate accounts already merged, and the merge is not detectable from the database, because a collision never produced two rows to compare: the second user's identity was never created and the surviving row looks legitimate. Deployments running more than one connection must audit out of band, by exporting each connection's set of sub values from its identity provider and intersecting them. Any sub present in more than one set identifies an account that may have been merged.

Sources and claim methodology

Upstream source description

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "<name>/<connection_id>", but that namespacing never takes effect. __connection_id__ is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose __connection_id__ is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space. This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.

Quoted source text, attributed separately from HOL analysis.

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverCVE-2026-91039

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverCVE-2026-91039

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology