Skip to content
Threat Feed
Subscribe

Vendor

Team Alembic

1 brief RSS
medium advisory

CVE-2026-49757: AshAuthentication OAuth2/OIDC Account Takeover

AshAuthentication incorrectly uses email addresses to link OAuth2/OIDC identities to local accounts, enabling unauthenticated account takeover via identity providers that allow unverified or reclaimed emails.

AshAuthentication account-takeover cve-2026-49757 oauth oidc authentication-bypass
1t 1c