AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
Affects ash_authentication 5.0.0-rc.0 through rc.15 where TOTP setup or confirm_setup is exposed on a caller-chosen record and confirm_setup_enabled? is true. Fixed in 5.0.0-rc.16.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 5.0.0-rc.16
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The application exposes the TOTP setup or confirm_setup action on a record the caller identifies, and the attacker can read the victim's user record. Installing the attacker's secret requires confirm_setup_enabled? true.
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Affects Hex packages
- Severity8.6/10CVSS 7.6, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 77 if added to CISA KEV
- Would score about 72 if CISA's SSVC rates exploitation active
- Would score about 34 if CISA's SSVC rates it automatable
CVE-2026-119215 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.6 (high) and affects ash_authentication; fixed in 5.0.0-rc.16.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 27/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 5.0.0-rc.16
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
AshAuthentication, an Elixir authentication library used in applications built with the Ash framework, is affected: a user can install their own two-factor (TOTP) authenticator secret on another user's account. This lets an attacker sign in as the victim or hold the victim's second factor, and in some setups reveal the victim's pending setup secret.
Read the original description
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
What to do
Check whether your setup matches what the bug needs.
The application exposes the TOTP setup or confirm_setup action on a record the caller identifies, and the attacker can read the victim's user record. Installing the attacker's secret requires confirm_setup_enabled? true.Upgrade to a fixed version: 5.0.0-rc.16.
Workaround: Do not expose setup or confirm_setup on a record the caller chooses.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- ash_authenticationHex
From 5.0.0-rc.0 · fixed in 5.0.0-rc.16
- team-alembic/ash_authentication
Version range not reported
- ash_authenticationHex
From 5.0.0-rc.0 · fixed in 5.0.0-rc.16
Evidence 5
- Advisory
- Patch
- Repository
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-119215
Is CVE-2026-119215 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A signed-in user can attach their own authenticator secret to a different user's account when the TOTP setup action picks the target record from the caller's input. The attacker can then sign in as the victim or use the victim's second factor.Source: github.com, cna.erlef.org
Which versions are affected by CVE-2026-119215?
ash_authentication (Hex): from 5.0.0-rc.0 before 5.0.0-rc.16. ash_authentication (Hex): from 5.0.0-rc.0 before 5.0.0-rc.16.Source: cve.now feed data
Am I affected, and how do I check?
ash_authentication versions from 5.0.0-rc.0 up to but not including 5.0.0-rc.16 are affected. The setup needs the TOTP setup or confirm_setup action exposed on a record the caller identifies, the attacker able to read the victim's user record, and confirm_setup_enabled? set to true. Check the installed ash_authentication version in mix.lock or deps, and check the TOTP strategy configuration for confirm_setup_enabled?.Source: github.com, cna.erlef.org
How do I fix CVE-2026-119215?
Upgrade ash_authentication to 5.0.0-rc.16 or later. Until the upgrade is applied, stop exposing setup or confirm_setup on a record the caller chooses.Source: github.com, cna.erlef.org