Executive Summary

CVE-2026-49757 is an authentication bypass vulnerability in the AshAuthentication library used for OAuth2/OIDC sign-in. The issue arises because the library matched local users by their email address instead of the OpenID Connect issuer (iss) and subject (sub) claims, which are the only stable and unique identifiers for users according to the OpenID Connect specification.

This flaw allows an attacker to register an account on any accepted OAuth provider using a victim's email address—even if the email is unverified, reused, or marked as email_verified: false—and gain access to the victim's existing local account with full privileges. The vulnerability affects versions of AshAuthentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10.

The fix involves changing the user resolution mechanism to rely on the (strategy, sub) identity stored in a user identity resource, and only linking a new sub to an existing local account by email when the provider's email_verified claim is trusted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a critical security impact by allowing an unauthenticated attacker to take over local user accounts. By exploiting the email-based user matching flaw, an attacker can gain full local privileges of the victim's account without needing to authenticate legitimately.

The attacker can register an account on an OAuth provider with the victim's email and then sign in through the vulnerable AshAuthentication system, which incorrectly associates the attacker with the victim's local account.

This results in a complete account takeover, potentially exposing sensitive data, allowing unauthorized actions, and compromising the security of the affected application.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-49757 vulnerability, immediately upgrade AshAuthentication to version 4.14.0 or later, or to 5.0.0-rc.10 or later if using the 5.x release candidates.

Ensure that all OAuth2 and OIDC strategies require and use the mandatory identity_resource option, which resolves users by the (strategy, sub) identity rather than by email.

Configure the trust_email_verified? option carefully to only trust providers that reliably assert email ownership, so that linking by email is only allowed when the email_verified claim is trusted.

Set the on_untrusted_email_match option to :reject (default) to refuse sign-ins when the email cannot be trusted, or to :confirm to require email confirmation before linking accounts.

Review and update your OAuth provider configurations and documentation to align with the new identity verification mechanisms introduced in the patches.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an unauthenticated attacker to take over local user accounts by exploiting improper user matching during OAuth2/OIDC sign-in, leading to unauthorized access to user data and privileges.

Such unauthorized access can result in violations of data protection regulations like GDPR and HIPAA, which require strict controls on user authentication and access to personal or sensitive information.

Because the flaw enables account takeover without proper verification, it undermines the security assurances needed to comply with these standards, potentially leading to data breaches and regulatory non-compliance.

Useful 0 Not Useful 0