CVE-2026-119215

Name of the Vulnerable Software and Affected Versions ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.15

Description An authorization bypass allows an authenticated user to install a Time-based One-Time Password (TOTP) secret they control onto another user's account, enabling them to sign in as that user or control their second factor. The function AshAuthentication.Strategy.Totp.ConfirmSetupChange() verified a setup token without confirming it was issued to the record being updated. Additionally, the changesets ConfirmSetupChange, GeneratePendingSetupChange, and GenerateSecretChange were marked as AshAuthentication interactions, which bypassed standard policies. Consequently, policies restricting setup and confirm setup to the actor's own record were ignored when these actions were exposed by record key, allowing a direct setup call on another user's record to return that user's pending secret and setup token.

Recommendations Update ash authentication to version 5.0.0-rc.16 or later. As a temporary workaround, do not expose setup or confirm setup on a record chosen by the caller; instead, call them through AshAuthentication.Strategy.Totp.Actions using the signed-in user.