AIKIDO-2026-193724
ash_authentication is vulnerable to Authentication Bypass
91
Critical Risk
This Affects:
ash_authenticationTL;DR
In ash_authentication, require_confirmed_with is not enforced on the action and fails open on an unreadable attribute in AshAuthentication. AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_authentication is vulnerable to Authentication Bypass in versions 4.3.8 - 4.14.2.
How to fix this
Upgrade the ash_authentication library to the patch version.
Links
Fix Commits
github.com/team-alembic/ash_authentication/commit/1076639a9d40213088d110c79ba6735b8cc85b16github.com/team-alembic/ash_authentication/commit/17f4c25a372d1778c9cc457759e6357570d83711github.com/team-alembic/ash_authentication/commit/7d37bc6e4df6697b5813d2f373f0fdb08f813f98
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.