https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 04:50:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119215 <p>Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user&#39;s account, and then sign in as that user or hold their second factor.</p> <p>AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker&#39;s own pending secret could be confirmed onto another user&#39;s record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor&#39;s own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user&#39;s record returned that user&#39;s pending secret and setup token.</p> <p>This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.</p> <p>Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user&#39;s account, and then sign in as that user or hold their second factor.</p> <p>AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker&#39;s own pending secret could be confirmed onto another user&#39;s record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor&#39;s own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user&#39;s record returned that user&#39;s pending secret and setup token.</p> <p>This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119215