{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119215", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-11-03T03:30:01.648Z", "datePublished": "2026-11-03T15:46:32.432Z", "dateUpdated": "2026-11-03T17:49:28.211Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange'"], "packageName": "ash_authentication", "packageURL": "pkg:hex/ash_authentication", "product": "ash_authentication", "programFiles": ["lib/ash_authentication/strategies/totp/confirm_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_secret_change.ex"], "programRoutines": [{"name": "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange':change/3"}], "repo": "https://github.com/team-alembic/ash_authentication", "vendor": "team-alembic", "versions": [{"lessThan": "5.0.0-rc.16", "status": "affected", "version": "5.0.0-rc.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange'"], "packageName": "team-alembic/ash_authentication", "packageURL": "pkg:github/team-alembic/ash_authentication", "product": "ash_authentication", "programFiles": ["lib/ash_authentication/strategies/totp/confirm_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_secret_change.ex"], "programRoutines": [{"name": "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange':change/3"}], "repo": "https://github.com/team-alembic/ash_authentication", "vendor": "team-alembic", "versions": [{"lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574", "status": "affected", "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An application exposes the TOTP <code>setup</code> or <code>confirm_setup</code> action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to <code>AshAuthentication.Strategy.Totp.Actions.confirm_setup/3</code>, and the attacker can read the victim's user record. Installing the attacker's secret requires <code>confirm_setup_enabled? true</code>; signing in with it alone requires <code>sign_in_enabled? true</code>. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "An application exposes the TOTP `setup` or `confirm_setup` action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to `AshAuthentication.Strategy.Totp.Actions.confirm_setup/3`, and the attacker can read the victim's user record. Installing the attacker's secret requires `confirm_setup_enabled? true`; signing in with it alone requires `sign_in_enabled? true`. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."}], "value": "An application exposes the TOTP setup or confirm_setup action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to AshAuthentication.Strategy.Totp.Actions.confirm_setup/3, and the attacker can read the victim's user record. Installing the attacker's secret requires confirm_setup_enabled? true; signing in with it alone requires sign_in_enabled? true. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.0.0-rc.16", "versionStartIncluding": "5.0.0-rc.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "eliteaja11-dev"}, {"lang": "en", "type": "reporter", "value": "eliteaja11-dev"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel / Ash Project"}], "dateAssigned": "2026-11-03T03:41:55.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.</p>\n<p><code>AshAuthentication.Strategy.Totp.ConfirmSetupChange</code> verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, <code>ConfirmSetupChange</code>, <code>GeneratePendingSetupChange</code> and <code>GenerateSecretChange</code>, also marked their changesets as AshAuthentication interactions, which the standard <code>AshAuthenticationInteraction</code> policy bypass lets through. A policy limiting <code>setup</code> and <code>confirm_setup</code> to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct <code>setup</code> call on another user's record returned that user's pending secret and setup token.</p>\n<p>This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.</p>"}, {"base64": false, "type": "text/markdown", "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\n`AshAuthentication.Strategy.Totp.ConfirmSetupChange` verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, `ConfirmSetupChange`, `GeneratePendingSetupChange` and `GenerateSecretChange`, also marked their changesets as AshAuthentication interactions, which the standard `AshAuthenticationInteraction` policy bypass lets through. A policy limiting `setup` and `confirm_setup` to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct `setup` call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-03T15:46:32.432Z"}, "references": [{"name": "TOTP setup in AshAuthentication lets a user install their own authenticator secret on another user's account", "tags": ["vendor-advisory", "related"], "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c"}, {"name": "EEF CNA record for CVE-2026-119215", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-119215.html"}, {"name": "OSV record EEF-CVE-2026-119215", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215"}, {"name": "Introducing commit 6e7a880 in team-alembic/ash_authentication", "tags": ["related"], "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1"}, {"name": "Fix commit 4058be0 in team-alembic/ash_authentication", "tags": ["patch"], "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"}], "source": {"discovery": "EXTERNAL"}, "title": "AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Do not expose <code>setup</code> or <code>confirm_setup</code> on a record the caller chooses. Call them through <code>AshAuthentication.Strategy.Totp.Actions</code> with the signed-in user, as the built-in routes do.</p>"}, {"base64": false, "type": "text/markdown", "value": "Do not expose `setup` or `confirm_setup` on a record the caller chooses. Call them through `AshAuthentication.Strategy.Totp.Actions` with the signed-in user, as the built-in routes do."}], "value": "Do not expose setup or confirm_setup on a record the caller chooses. Call them through AshAuthentication.Strategy.Totp.Actions with the signed-in user, as the built-in routes do."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:49:11.213752Z", "id": "CVE-2026-119215", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:49:28.211Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange'"], "packageName": "ash_authentication", "packageURL": "pkg:hex/ash_authentication", "product": "ash_authentication", "programFiles": ["lib/ash_authentication/strategies/totp/confirm_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_secret_change.ex"], "programRoutines": [{"name": "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange':change/3"}], "repo": "https://github.com/team-alembic/ash_authentication", "vendor": "team-alembic", "versions": [{"lessThan": "5.0.0-rc.16", "status": "affected", "version": "5.0.0-rc.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange'", "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange'"], "packageName": "team-alembic/ash_authentication", "packageURL": "pkg:github/team-alembic/ash_authentication", "product": "ash_authentication", "programFiles": ["lib/ash_authentication/strategies/totp/confirm_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex", "lib/ash_authentication/strategies/totp/generate_secret_change.ex"], "programRoutines": [{"name": "'Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange':change/3"}, {"name": "'Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange':change/3"}], "repo": "https://github.com/team-alembic/ash_authentication", "vendor": "team-alembic", "versions": [{"lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574", "status": "affected", "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."}], "id": "CVE-2026-119215", "lastModified": "2026-11-03T16:17:21.810", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-11-03T16:17:21.683", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-119215.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"created": "2026-11-03T17:30:08.489220+00:00", "updated": "2026-11-03T17:30:08.489225+00:00", "vendors": []}