Loading story…
A critical vulnerability, CVE-2026-49757 (CVSS 9.2), allows authentication bypass and account takeover in team-alembic's AshAuthentication Elixir library during OAuth2/OIDC federated sign-in. Vulnerable deployments may associate a login with an existing local account based on a mutable, unverified email claim instead of a stable issuer-and-subject identity, enabling an attacker using a weak or attacker-controlled identity provider to impersonate a victim.
The issue affects AshAuthentication versions 0.1.0 through versions before 4.14.0, and 5.0.0-rc.0 through versions before 5.0.0-rc.10; upgrades to 4.14.0 or 5.0.0-rc.10 remediate the flaw. Organizations using OAuth2/OIDC should verify durable identity mappings through identity_resource and avoid trusting mutable email claims for account linking. A public proof of concept is available, although active exploitation has not been observed.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The public advisory and CVE-2026-49757 identifier were released, describing a critical flaw that could let attackers impersonate users when vulnerable applications matched federated logins using unverified email claims.
team-alembic published AshAuthentication 4.14.0 and 5.0.0-rc.10 to fix an OAuth2/OIDC authentication-bypass issue. The releases require identity_resource configuration and correct identity-record persistence for stable provider identity mapping.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026
A high-severity authentication flaw, **CVE-2026-93355**, in LiteLLM's JWT identity-resolution flow can let an attacker impersonate an existing user by presenting a valid token from the configured identity provider with the victim's email address. When subject-based matching fails, affected versions perform a case-insensitive email fallback without verifying the `email_verified` claim. An attacker targeting a `proxy_admin` account could access administrative endpoints, user and key records, and upstream LLM-provider API keys managed by the LiteLLM proxy. The fallback can also overwrite the victim's stored `sso_user_id` with the attacker's JWT subject, turning the initial impersonation into persistent access. LiteLLM versions through **1.102.1** are affected, with **1.102.2** and later fixing the issue; public reporting found no known active exploitation or CISA KEV listing. Organizations should upgrade immediately, investigate identity-binding changes, rotate exposed virtual and provider API keys, and reject JWTs that lack verified email claims until remediation is complete.
Sep 29, 2026
Apache disclosed **CVE-2026-48911**, a moderate-severity vulnerability in Apache Answer affecting versions through **2.0.1** that can let an unauthenticated attacker take over arbitrary user accounts. The flaw stems from insufficient verification of data authenticity caused by a missing authorization check in the external-login email-binding confirmation flow, allowing abuse of the existing user confirmation process. According to the disclosure, exploitation requires tricking a victim into clicking a crafted confirmation link, after which the attacker can bind access and seize the targeted account. Apache said the issue is fixed in **Apache Answer 2.0.2** and urged users to upgrade; the vulnerability was credited to researchers **tonghuaroot** and **yangxi**.
Aug 5, 2026