CVE-2026-49757

Περιγραφή

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication-s OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers. A provider login presenting a victim-s email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim-s existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim-s email (or who benefits from provider-side email reuse or reclamation) obtains the victim-s full local privileges. The fix resolves users by the (strategy, sub) identity s...