CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
02 Description
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.66% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 51.1% of scored records. A rank, not a probability.
- NVD base score
- 9.1 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Deferred. NVD last modified this record on 2026-09-18.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-09-17 15:19Z1 MO AGO
- Last updated
- 2026-09-17 19:40Z1 MO AGO
- Reserved
- 2026-09-15
- Assigning CNA
- EEF
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.1)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-290Authentication Bypass by SpoofingBase
- Data version
- 5.2
- Document digest
- 7df6e372f959869236824d4801173ef670bdd6eae67b41d9ea87cf321c747e0c
05 Affected products
06 References
- github.comGitHub Advisoryhttps://github.com/team-alembic/ash_authentication/security/advisories/GHSA-73j9-m294-fvv9
- cna.erlef.orgEEF CNA record for CVE-2026-91039https://cna.erlef.org/cves/CVE-2026-91039.html
- osv.devOSV record EEF-CVE-2026-91039https://osv.dev/vulnerability/EEF-CVE-2026-91039
- github.comIntroducing commit 6453064 in team-alembic/ash_authenticationhttps://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14aeb83a77597a0034b7
- github.comFix commit 73ad16e in team-alembic/ash_authenticationhttps://github.com/team-alembic/ash_authentication/commit/73ad16e452670bbf843550a13361bd41e72ad964
07 Remediation
Upgrading is not sufficient on its own, for two reasons. Namespacing changes the value the identity lookup keys on, so UserIdentity rows written before the fix, all holding the bare strategy name, no longer match. Each row's strategy must be relinked in place to "<name>/<connection_id>". Deleting the rows does not work: the block is the account match that follows, refused under the default on_untrusted_email_match :reject whether the row exists or not, and deleting also discards the stored refresh token. Where a deployment has one connection the mapping is unambiguous and the update is mechanical, but it must run in the same deployment as the upgrade and before users sign in, or a newly written namespaced row can collide with a surviving bare row on the (uid, strategy) index. The fix also cannot separate accounts already merged, and the merge is not detectable from the database, because a collision never produced two rows to compare: the second user's identity was never created and the surviving row looks legitimate. Deployments running more than one connection must audit out of band, by exporting each connection's set of sub values from its identity provider and intersecting them. Any sub present in more than one set identifies an account that may have been merged.