CVE-2026-49757 — AshAuthentication OAuth2/OIDC Account Takeover

Proof of Concept for CVE-2026-49757 — a critical vulnerability in AshAuthentication where OAuth2/OIDC callbacks resolved to local user accounts by email address instead of the (strategy, sub) identity pair, allowing unauthenticated account takeover.

Attack Summary

1. Victim registers on a target application using AshAuthentication
2. Attacker registers on any accepted OAuth provider using the victim's email
3. Attacker signs in via OAuth — the app matches by email and creates a session for the victim's account

No victim credentials are needed. The attacker needs only the victim's email address and an account on any OAuth provider the target accepts.

Requirements

• Python 3.8+
• Standard library only (no pip install needed)

Usage

# Interactive mode (recommended)
python3 exploit.py

# Non-interactive mode (piped input)
echo | python3 exploit.py

What the PoC Demonstrates

Phase 1: Vulnerable Handler (Email Matching)

Simulates AshAuthentication's IdentityChange.change/3 with upsert_identity: :unique_email:

• Victim registers with [email protected] (role: admin)
• Victim links Google OAuth account (sub: google-victim-real-12345)
• Attacker registers on Keycloak with [email protected] (email_verified: false)
• Attacker initiates OAuth login → app matches by email → attacker gets victim's session

Phase 2: Fixed Handler — :reject Policy (default)

Simulates the patched UserResolver with (strategy, sub) lookup:

• Attacker's sub (keycloak-attacker-fake-789) is not found in user_identities
• on_untrusted_email_match: :reject blocks the login
• Attack prevented

Phase 3: Fixed Handler — :confirm Policy

• Attacker attempts OAuth login with victim's email
• System sends a confirmation token to the victim's email
• Identity is only linked if the victim confirms
• Attack prevented (attacker doesn't control the email inbox)

Phase 4: Fixed Handler — trust_email_verified? = true

• Legitimate user signs in via Google with email_verified: true → auto-linking succeeds
• Attacker signs in via Keycloak with email_verified: false → blocked
• Convenience preserved for trusted providers, safety for untrusted ones

Files

The Fix (ash_authentication >= 4.14.0)

1. UserResolver module — resolves users by (strategy, sub) identity instead of email
2. on_untrusted_email_match option — :reject (default), :confirm, or :warn for unknown subs
3. trust_email_verified? option — per-provider flag, defaults true for GitHub/Google/Auth0/Slack/Apple
4. Identity unique key — changed from (strategy, uid, user_id) to (strategy, uid)
5. Upsert restrictions — user_id is never updated on conflict
6. Compile-time warnings — for strategies without identity_resource

References

• NVD — CVE-2026-49757
• GHSA-777c-2fxx-qr28
• OpenID Connect Core §5.7 — Claim Stability
• AshAuthentication on Hex.pm

Disclaimer

This PoC is for educational and defensive testing purposes only. Only test against systems you own or have explicit authorization to test.