Ash Authentication: 16 Critical Auth Bypass and Session Flaws Disclosed Together
Team Alembic's Ash Authentication product faces a batch of 16 vulnerabilities disclosed on Sept 17, 2026, including critical flaws in authentication bypass and session management.
Key findings
- Sixteen vulnerabilities in Ash Authentication disclosed on Sept 17, 2026, with a focus on critical authentication bypass and session management flaws.
- Critical flaws include session fixation (CVE-2026-86688) and authentication bypass via cookie spoofing (CVE-2026-76949) and OAuth2 identity linking (CVE-2026-88952).
- Insufficient session expiration (CVE-2026-86533) and TOCTOU race conditions (CVE-2026-82761) allow for persistent or replayed authenticated sessions.
- Account takeover is possible via confirmation token reuse (CVE-2026-82685) and replay of single-use sign-in tokens from logs (CVE-2026-81632).
- Low severity issues include log forgery (CVE-2026-86522) and disclosure of sensitive information like password digests (CVE-2026-82723) in audit logs.
- Users should prioritize patching and reviewing configurations due to the breadth and severity of the disclosed authentication weaknesses.
On September 17, 2026, a batch of sixteen vulnerabilities was disclosed for Team Alembic's Ash Authentication product. The vulnerabilities, disclosed within an eight-hour window, span a range of severity levels from Low to Critical, with a significant cluster of Critical-severity flaws impacting authentication and session management. These disclosures highlight potential weaknesses in how Ash Authentication handles user sessions, identity verification, and token management.
Several vulnerabilities center on authentication bypass and session fixation. CVE-2026-76949, CVE-2026-91039, and CVE-2026-88952 all describe authentication bypass mechanisms. CVE-2026-76949 allows an attacker to spoof a remember-me cookie to hijack a session, while CVE-2026-91039 enables an attacker to sign in as a local user by manipulating an identity provider connection. Similarly, CVE-2026-88952 permits an attacker to link an OAuth2 identity to an incorrect account, effectively taking over another user's session. CVE-2026-86688 details a session fixation vulnerability where an attacker can plant a session identifier, leading to an authenticated session for the victim.
Other critical issues relate to session expiration and token handling. CVE-2026-86533 and CVE-2026-81637 both involve insufficient session expiration. The former allows revoked sessions to remain active, while the latter enables an attacker to replay an OAuth2 state value to sign a victim into an attacker-controlled account. CVE-2026-82761 describes a TOCTOU race condition with magic links, allowing replay attacks for authentication. CVE-2026-81632 highlights a vulnerability where single-use sign-in tokens can be recovered from HTTP request logs. CVE-2026-80218 indicates that a sign-in token for one resource can be used to authenticate for a different resource.
Medium and Low severity vulnerabilities were also disclosed. CVE-2026-86522 involves improper output neutralization for logs, allowing an unauthenticated attacker to forge log entries. CVE-2026-82760 points to inefficient algorithmic complexity in base62 decoding, potentially leading to CPU and memory exhaustion. CVE-2026-82759 and CVE-2026-82723 relate to the audit log add-on; the former allows recovery of client IP addresses due to predictable salt usage in hashing, and the latter discloses user password digests in the audit store. CVE-2026-82685, a High severity flaw, allows an authenticated attacker to overwrite another user's email address, leading to account takeover. Finally, CVE-2026-78223 involves improper verification of cryptographic signatures in the token revocation action, allowing manipulation of revocation or arbitrary writes to the token resource.
The batch of sixteen CVEs disclosed on September 17, 2026, underscores the importance of robust security practices in authentication systems. Users of Ash Authentication should prioritize applying patches and reviewing their configurations to mitigate the risks associated with these vulnerabilities. The concentration of critical authentication bypass and session management flaws suggests a need for thorough security audits of authentication flows.
The vulnerabilities were disclosed on September 17, 2026. The affected product is Ash Authentication by Team Alembic. The disclosures include critical authentication bypass flaws, session fixation, and insufficient session expiration issues.
Key findings include:
- Critical authentication bypass vulnerabilities allow attackers to hijack sessions via spoofed cookies or by manipulating identity provider connections.
- Session fixation and insufficient session expiration flaws enable attackers to maintain or exploit authenticated sessions.
- Vulnerabilities in token handling and cryptographic signature verification allow for token replay and resource manipulation.
- Log forgery and sensitive information disclosure issues were found in the audit log add-on.
- A TOCTOU race condition with magic links allows for replay attacks.
- A High severity flaw enables account takeover by overwriting user email addresses.