External risk intelligence

AshAuthentication Bypass Allows Unconfirmed User Session

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-85500

The vulnerability affects an authentication library used in web applications and API layers (GraphQL/JSON:API). Since these components are typically deployed as internet-facing web services to handle user registration and login, they are commonly exposed to the public internet.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in an authentication library that could allow unconfirmed users to gain sessions, bypassing a required email confirmation step. This issue could potentially impact systems that rely on this library for user authentication and registration, especially those exposed externally. The main concern at this time is to confirm if our environment utilizes this specific technology and assess any exposure.

Unconfirmed users can bypass required email confirmation.
Affects external-facing authentication and registration systems.
Confirm relevance and exposure to the technology.

Attack Path

How an attacker could exploit the issue

An unconfirmed user can bypass the email confirmation step during account creation or login, allowing them to obtain a session. This is possible because the `require_confirmed_with` attribute is not consistently checked, especially when API layers directly invoke the authentication action or when the confirmation attribute is not loaded or is hidden from the user. The vulnerability could lead to unauthorized session acquisition.

No user confirmation required.
Bypass email verification.
Unauthorized session granted.

Live Threat

Current exploitation, exposure, and threat context

This authentication bypass vulnerability could allow unconfirmed users to obtain a session without completing email verification. This may occur when API layers directly invoke authentication actions, bypassing confirmation checks. The affected system is `ash_authentication` and its related strategies.

Unconfirmed user sessions.
API layers bypassing checks.
Unauthorized access to services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability likely impacts teams responsible for user account management and API integrations. The first practical step is to identify all instances of the affected authentication library, confirm their reachability and business criticality, and then assign an accountable owner for remediation.

Confirm affected library deployment and ownership.
Verify public exposure and business impact.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ash_authentication library used for?

AshAuthentication is an Elixir-based library designed to manage user authentication workflows within applications built on the Ash Framework. Developers use it to handle core tasks like user registration, password validation, and account session management. By providing pre-built strategies, it simplifies the complex logic required to verify user identities and secure account access in web applications.

What does the Authentication Bypass in CVE-2026-85500 mean?

This vulnerability, classified as CWE-305, is an authentication bypass. It occurs because the library incorrectly evaluates user confirmation status. Instead of checking if a user has completed email verification, the system misinterprets certain data states as 'confirmed.' Because the check fails to identify unconfirmed accounts, attackers can gain an active session without ever fulfilling the mandatory email confirmation requirement.

How does an attacker trigger this CVE-2026-85500 flaw?

The flaw is triggered when an application uses API layers like GraphQL or JSON:API to directly invoke authentication actions. The bug does not trigger if the confirmation attribute is properly loaded and visible to the system. However, when the attribute is hidden by field policies or omitted from data loads, the system defaults to assuming the user is confirmed, allowing the bypass to succeed during registration or login attempts.

Why is this CVE-2026-85500 relevant to internet-facing systems?

Halo Surface Signal indicates this vulnerability is highly relevant because AshAuthentication is commonly deployed in internet-facing web services to handle public-facing account registration. Since these services are directly reachable, any application using the affected versions and exposing authentication endpoints to the public internet is at risk of unauthorized session creation.

How should I respond if I use ash_authentication?

Begin by auditing your codebase to identify all projects utilizing the vulnerable versions of the library. Prioritize services that are internet-facing or handle critical user data. Once identified, coordinate with your development team to plan an update to a patched version, ensuring that the integration points between your API layer and authentication actions are correctly configured to enforce confirmation checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.