CVE-2026-119215 (GCVE-0-2026-119215)

Vulnerability from cvelistv5 – Published: 2026-11-03 15:46 – Updated: 2026-11-03 17:49
VLAI
Title
AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
Summary
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
Severity
7.6 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:49 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
EEF CNA under the mitre root
CNA scorecard A 97/100 over 347 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
team-alembic ash_authentication Affected: 5.0.0-rc.0 , < 5.0.0-rc.16 (semver)
    cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Create a notification for this product.
team-alembic ash_authentication Affected: 6e7a880698614887527a87df206b4eb0c0fbd8c1 , < 4058be0f519c2e9b0d2266e90f9c7d8547d54574 (git)
    cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
eliteaja11-dev eliteaja11-dev Zach Daniel / Ash Project
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:49:11.213752Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T17:49:28.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
          ],
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "5.0.0-rc.16",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
          ],
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574",
              "status": "affected",
              "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn application exposes the TOTP \u003ccode\u003esetup\u003c/code\u003e or \u003ccode\u003econfirm_setup\u003c/code\u003e action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to \u003ccode\u003eAshAuthentication.Strategy.Totp.Actions.confirm_setup/3\u003c/code\u003e, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires \u003ccode\u003econfirm_setup_enabled? true\u003c/code\u003e; signing in with it alone requires \u003ccode\u003esign_in_enabled? true\u003c/code\u003e. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "An application exposes the TOTP `setup` or `confirm_setup` action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to `AshAuthentication.Strategy.Totp.Actions.confirm_setup/3`, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires `confirm_setup_enabled? true`; signing in with it alone requires `sign_in_enabled? true`. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."
            }
          ],
          "value": "An application exposes the TOTP setup or confirm_setup action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to AshAuthentication.Strategy.Totp.Actions.confirm_setup/3, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires confirm_setup_enabled? true; signing in with it alone requires sign_in_enabled? true. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.16",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "eliteaja11-dev"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "eliteaja11-dev"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        }
      ],
      "dateAssigned": "2026-11-03T03:41:55.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Strategy.Totp.ConfirmSetupChange\u003c/code\u003e verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, \u003ccode\u003eConfirmSetupChange\u003c/code\u003e, \u003ccode\u003eGeneratePendingSetupChange\u003c/code\u003e and \u003ccode\u003eGenerateSecretChange\u003c/code\u003e, also marked their changesets as AshAuthentication interactions, which the standard \u003ccode\u003eAshAuthenticationInteraction\u003c/code\u003e policy bypass lets through. A policy limiting \u003ccode\u003esetup\u003c/code\u003e and \u003ccode\u003econfirm_setup\u003c/code\u003e to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct \u003ccode\u003esetup\u003c/code\u003e call on another user\u0027s record returned that user\u0027s pending secret and setup token.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\n`AshAuthentication.Strategy.Totp.ConfirmSetupChange` verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, `ConfirmSetupChange`, `GeneratePendingSetupChange` and `GenerateSecretChange`, also marked their changesets as AshAuthentication interactions, which the standard `AshAuthenticationInteraction` policy bypass lets through. A policy limiting `setup` and `confirm_setup` to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct `setup` call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
            }
          ],
          "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T15:46:32.432Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "TOTP setup in AshAuthentication lets a user install their own authenticator secret on another user\u0027s account",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c"
        },
        {
          "name": "EEF CNA record for CVE-2026-119215",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-119215.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-119215",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215"
        },
        {
          "name": "Introducing commit 6e7a880 in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1"
        },
        {
          "name": "Fix commit 4058be0 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AshAuthentication TOTP setup lets a user install their own authenticator secret on another user\u0027s account",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not expose \u003ccode\u003esetup\u003c/code\u003e or \u003ccode\u003econfirm_setup\u003c/code\u003e on a record the caller chooses. Call them through \u003ccode\u003eAshAuthentication.Strategy.Totp.Actions\u003c/code\u003e with the signed-in user, as the built-in routes do.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Do not expose `setup` or `confirm_setup` on a record the caller chooses. Call them through `AshAuthentication.Strategy.Totp.Actions` with the signed-in user, as the built-in routes do."
            }
          ],
          "value": "Do not expose setup or confirm_setup on a record the caller chooses. Call them through AshAuthentication.Strategy.Totp.Actions with the signed-in user, as the built-in routes do."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-119215",
    "datePublished": "2026-11-03T15:46:32.432Z",
    "dateReserved": "2026-11-03T03:30:01.648Z",
    "dateUpdated": "2026-11-03T17:49:28.211Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-119215",
      "date": "2026-11-04",
      "epss": "0.00505",
      "percentile": "0.43294"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
                  "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
                  "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
                ],
                "packageName": "ash_authentication",
                "packageURL": "pkg:hex/ash_authentication",
                "product": "ash_authentication",
                "programFiles": [
                  "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
                  "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
                  "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
                  },
                  {
                    "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
                  },
                  {
                    "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
                  }
                ],
                "repo": "https://github.com/team-alembic/ash_authentication",
                "vendor": "team-alembic",
                "versions": [
                  {
                    "lessThan": "5.0.0-rc.16",
                    "status": "affected",
                    "version": "5.0.0-rc.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
                  "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
                  "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
                ],
                "packageName": "team-alembic/ash_authentication",
                "packageURL": "pkg:github/team-alembic/ash_authentication",
                "product": "ash_authentication",
                "programFiles": [
                  "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
                  "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
                  "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
                  },
                  {
                    "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
                  },
                  {
                    "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
                  }
                ],
                "repo": "https://github.com/team-alembic/ash_authentication",
                "vendor": "team-alembic",
                "versions": [
                  {
                    "lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574",
                    "status": "affected",
                    "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
          }
        ],
        "id": "CVE-2026-119215",
        "lastModified": "2026-11-03T18:17:55.197",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-119215",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:49:11.213752Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-03T16:17:21.683",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-119215.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-119215",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-11-03T17:49:11.213752Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-11-03T17:49:23.196Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
                "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
                "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
              ],
              "packageName": "ash_authentication",
              "packageURL": "pkg:hex/ash_authentication",
              "product": "ash_authentication",
              "programFiles": [
                "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
                "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
                "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
                },
                {
                  "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
                },
                {
                  "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
                }
              ],
              "repo": "https://github.com/team-alembic/ash_authentication",
              "vendor": "team-alembic",
              "versions": [
                {
                  "lessThan": "5.0.0-rc.16",
                  "status": "affected",
                  "version": "5.0.0-rc.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
                "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
                "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
              ],
              "packageName": "team-alembic/ash_authentication",
              "packageURL": "pkg:github/team-alembic/ash_authentication",
              "product": "ash_authentication",
              "programFiles": [
                "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
                "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
                "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
                },
                {
                  "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
                },
                {
                  "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
                }
              ],
              "repo": "https://github.com/team-alembic/ash_authentication",
              "vendor": "team-alembic",
              "versions": [
                {
                  "lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574",
                  "status": "affected",
                  "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn application exposes the TOTP \u003ccode\u003esetup\u003c/code\u003e or \u003ccode\u003econfirm_setup\u003c/code\u003e action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to \u003ccode\u003eAshAuthentication.Strategy.Totp.Actions.confirm_setup/3\u003c/code\u003e, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires \u003ccode\u003econfirm_setup_enabled? true\u003c/code\u003e; signing in with it alone requires \u003ccode\u003esign_in_enabled? true\u003c/code\u003e. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An application exposes the TOTP `setup` or `confirm_setup` action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to `AshAuthentication.Strategy.Totp.Actions.confirm_setup/3`, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires `confirm_setup_enabled? true`; signing in with it alone requires `sign_in_enabled? true`. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."
                }
              ],
              "value": "An application exposes the TOTP setup or confirm_setup action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to AshAuthentication.Strategy.Totp.Actions.confirm_setup/3, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires confirm_setup_enabled? true; signing in with it alone requires sign_in_enabled? true. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.0.0-rc.16",
                      "versionStartIncluding": "5.0.0-rc.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "eliteaja11-dev"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "eliteaja11-dev"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Zach Daniel / Ash Project"
            }
          ],
          "dateAssigned": "2026-11-03T03:41:55.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Strategy.Totp.ConfirmSetupChange\u003c/code\u003e verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, \u003ccode\u003eConfirmSetupChange\u003c/code\u003e, \u003ccode\u003eGeneratePendingSetupChange\u003c/code\u003e and \u003ccode\u003eGenerateSecretChange\u003c/code\u003e, also marked their changesets as AshAuthentication interactions, which the standard \u003ccode\u003eAshAuthenticationInteraction\u003c/code\u003e policy bypass lets through. A policy limiting \u003ccode\u003esetup\u003c/code\u003e and \u003ccode\u003econfirm_setup\u003c/code\u003e to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct \u003ccode\u003esetup\u003c/code\u003e call on another user\u0027s record returned that user\u0027s pending secret and setup token.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\n`AshAuthentication.Strategy.Totp.ConfirmSetupChange` verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, `ConfirmSetupChange`, `GeneratePendingSetupChange` and `GenerateSecretChange`, also marked their changesets as AshAuthentication interactions, which the standard `AshAuthenticationInteraction` policy bypass lets through. A policy limiting `setup` and `confirm_setup` to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct `setup` call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
                }
              ],
              "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-03T15:46:32.432Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "name": "TOTP setup in AshAuthentication lets a user install their own authenticator secret on another user\u0027s account",
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c"
            },
            {
              "name": "EEF CNA record for CVE-2026-119215",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-119215.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-119215",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215"
            },
            {
              "name": "Introducing commit 6e7a880 in team-alembic/ash_authentication",
              "tags": [
                "related"
              ],
              "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1"
            },
            {
              "name": "Fix commit 4058be0 in team-alembic/ash_authentication",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "AshAuthentication TOTP setup lets a user install their own authenticator secret on another user\u0027s account",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eDo not expose \u003ccode\u003esetup\u003c/code\u003e or \u003ccode\u003econfirm_setup\u003c/code\u003e on a record the caller chooses. Call them through \u003ccode\u003eAshAuthentication.Strategy.Totp.Actions\u003c/code\u003e with the signed-in user, as the built-in routes do.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Do not expose `setup` or `confirm_setup` on a record the caller chooses. Call them through `AshAuthentication.Strategy.Totp.Actions` with the signed-in user, as the built-in routes do."
                }
              ],
              "value": "Do not expose setup or confirm_setup on a record the caller chooses. Call them through AshAuthentication.Strategy.Totp.Actions with the signed-in user, as the built-in routes do."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-119215",
        "datePublished": "2026-11-03T15:46:32.432Z",
        "dateReserved": "2026-11-03T03:30:01.648Z",
        "dateUpdated": "2026-11-03T17:49:28.211Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.