---
id: CVE-2026-119215
title: >-
  AshAuthentication TOTP setup lets a user install their own authenticator
  secret on another user's account
summary: >-
  Authorization Bypass Through User-Controlled Key vulnerability in team-alembic
  ash_authentication allows a user with an account to install a TOTP secret they
  control on another user's account, and then sign in as that user or hold their
  …
severity: high
cvss: 7.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: team-alembic
product: ash_authentication
affected:
  - ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.16
  - >-
    team-alembic/ash_authentication >= 6e7a880698614887527a87df206b4eb0c0fbd8c1
    < 4058be0f519c2e9b0d2266e90f9c7d8547d54574
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T17:49:11.213752Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:49:28.211Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119215'
references:
  - url: >-
      https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c
    label: >-
      TOTP setup in AshAuthentication lets a user install their own
      authenticator secret on another user's account
  - url: 'https://cna.erlef.org/cves/CVE-2026-119215.html'
    label: EEF CNA record for CVE-2026-119215
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-119215'
    label: OSV record EEF-CVE-2026-119215
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1
    label: Introducing commit 6e7a880 in team-alembic/ash_authentication
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574
    label: Fix commit 4058be0 in team-alembic/ash_authentication
tags:
  - cve.org
epss: 0.00505
epssPercentile: 0.43406
ingestedAt: '2026-11-05T20:33:06.334Z'
---

## Overview

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.

AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.

This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.

## Affected

- `ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.16`
- `team-alembic/ash_authentication >= 6e7a880698614887527a87df206b4eb0c0fbd8c1 < 4058be0f519c2e9b0d2266e90f9c7d8547d54574`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Do not expose setup or confirm_setup on a record the caller chooses. Call them through AshAuthentication.Strategy.Totp.Actions with the signed-in user, as the built-in routes do.