CVE-2026-49757
Summary
AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than by the OpenID Connect iss/sub claim combination. A provider login presenting a victim's email (including an unverified, reused, or email_verified: false account) resolved to and signed in as the victim's existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim's email obtains the victim's full local privileges.
Details
Per OpenID Connect Core §5.7, only the iss/sub claim combination uniquely and stably identifies an end-user; any other claim, including email, MUST NOT be used as a unique identifier. AshAuthentication's OAuth2/OIDC register flow nonetheless drove the upsert by the email field (upsert_identity on email, or a user-defined sign-in filter), and the sign-in preparation filtered users by email.
1. Provider login. The attacker signs in to a configured OAuth/OIDC provider with the victim's email. This is trivial for providers that don't verify email ownership, and possible under email-reuse / reclamation for providers that do.
2. AshAuthentication register step. 'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3 invokes the upsert action whose upsert_identity resolves on the email. The action lands on the victim's existing record.
3. Sign-in preparation. 'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3 does not verify the returned user against an iss/sub identity, so the attacker is authenticated as the victim.
Configurations
Exploitation requires one of:
- The configured OAuth/OIDC provider does not reliably verify email ownership (lets a user register with any email, or fails to verify it). Many social/enterprise providers fall into this category, including Slack, generic OIDC deployments, and any custom OAuth2 endpoint without strict email validation.
- The provider allows email reclamation: the victim's email becomes available
⚡ Watch CVE-2026-49757
Get an email if CVE-2026-49757 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-49757)