{"id":"CVE-2026-119215","kind":"vulnerability","aliases":["CVE-2026-119215"],"related":[],"title":"ash_authentication: TOTP setup flaw lets users take over other accounts' second factor","description":"Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.","summary":"ash_authentication is an Elixir authentication library for the Ash framework. A signed-in user can confirm their own TOTP secret onto another user's account, then sign in as that user or hold their second factor.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ash-framework","ash_authentication","elixir","package","totp","web-apps"],"not_affected_if":["auth-required-actions-restricted","no-totp","version-5.0.0-rc.16-or-later"],"how_to_check":"- Look for `ash_authentication` in `mix.lock` and note the version\n- Check whether TOTP is enabled through the `Totp` strategy and whether setup or confirm_setup actions are exposed by record key","fix":"- `ash_authentication` from `5.0.0-rc.16` onward (fixed in that release, per the affected range given)","status":"open","published_at":"2026-11-03T16:17:21+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","triaged_at":"2026-11-03T16:23:51+00:00","updated_at":"2026-11-03T16:23:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T16:23:51Z","model":"claude-haiku-5-5","output":{"fix":"- `ash_authentication` from `5.0.0-rc.16` onward (fixed in that release, per the affected range given)","reach":"internet","title":"ash_authentication: TOTP setup flaw lets users take over other accounts' second factor","impact":"high","summary":"ash_authentication is an Elixir authentication library for the Ash framework. A signed-in user can confirm their own TOTP secret onto another user's account, then sign in as that user or hold their second factor.","audience":"developers","category":"package","nicknames":[],"who_cares":["elixir","ash-framework","ash_authentication","totp","web-apps"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over another user's account and second factor","analyst_note":"","how_to_check":"- Look for `ash_authentication` in `mix.lock` and note the version\n- Check whether TOTP is enabled through the `Totp` strategy and whether setup or confirm_setup actions are exposed by record key","plain_action":"","needs_analyst":false,"not_affected_if":["no-totp","auth-required-actions-restricted","version-5.0.0-rc.16-or-later"],"who_is_affected":"Applications built on ash_authentication 5.0.0-rc.0 up to but not including 5.0.0-rc.16 that use the TOTP strategy and expose setup or confirm_setup actions by record key are exposed. Applications that do not use TOTP, or that restrict these actions to the actor's own record, are less exposed, though the bypass flaw still applies to the TOTP changes themselves.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4414,"output_tokens":582,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119215':16A,19A '-2026':15A,18A '5.0.0':219C,222C 'account':11A,57B,88C,100C 'action':190C 'actor':178C 'affect':215C 'alemb':80C 'allow':83C 'also':154C 'anoth':54B,97C,142C,200C 'app':30B 'applic':187C 'ash':1A,21B,23B,31B,40B,81C,216C 'ash-framework':20B 'ashauthent':159C 'ashauthentication.strategy.totp.confirmsetupchange':113C 'ashauthenticationinteract':164C 'attack':133C 'authent':2A,24B,32B,36B,82C,217C 'author':69C 'bypass':70C,166C 'call':198C 'chang':149C 'changeset':157C 'check':121C 'confirm':48B,130C,140C,174C 'confirmsetupchang':150C 'control':74C,95C 'could':138C 'cve':14A,17A 'direct':196C 'elixir':25B,35B 'expos':188C 'factor':13A,68B,112C 'flaw':5A 'framework':22B,41B 'generatependingsetupchang':151C 'generatesecretchang':153C 'hold':65B,109C 'instal':90C 'interact':160C 'issu':125C,214C 'key':75C,193C 'let':6A,167C 'librari':37B 'limit':171C 'mark':155C 'never':183C 'onto':53B,141C 'packag':26B 'pend':136C,208C 'polici':165C,170C 'ran':184C 'rc.0':220C 'rc.16':223C 'record':128C,145C,181C,192C,203C 'return':204C 'second':12A,67B,111C 'secret':52B,93C,137C,209C 'setup':4A,116C,148C,172C,175C,197C,211C 'sign':44B,59B,103C 'signed-in':43B 'standard':163C 'take':8A 'team':79C 'team-alemb':78C 'therefor':182C 'token':117C,212C 'totp':3A,27B,51B,92C,147C 'user':7A,46B,55B,63B,73C,85C,98C,107C,143C,201C,206C 'user-control':72C 'verifi':114C 'vulner':76C 'web':29B 'web-app':28B","nicknames":[],"mitigations":[],"who_affected":"Applications built on ash_authentication 5.0.0-rc.0 up to but not including 5.0.0-rc.16 that use the TOTP strategy and expose setup or confirm_setup actions by record key are exposed. Applications that do not use TOTP, or that restrict these actions to the actor's own record, are less exposed, though the bypass flaw still applies to the TOTP changes themselves.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ashauthentication","ashframework","elixir","high","package","totp","webapps"],"campaign_type":null,"first_public_at":"2026-11-03T15:31:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119215","severity":null,"published_at":"2026-11-03T16:17:21+00:00","modified_at":"2026-11-03T16:17:21+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","fetched_at":"2026-11-03T16:21:42+00:00","note":null}],"documents":[{"id":58804,"url":"https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58805,"url":"https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58806,"url":"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T15:31:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}