{"action":"Upgrade ash_authentication to 4.14.0 (4.x) or 5.0.0-rc.10 (5.x) or later.","affected":[{"fixed":"4.14.0","introduced":"0.1.0"},{"fixed":"5.0.0-rc.10","introduced":"5.0.0-rc.0"}],"component":"ash_authentication","cve_ids":["CVE-2026-49757"],"ecosystem":"Hex","epss":0.00615,"exploited":false,"fixed_versions":["4.14.0","5.0.0-rc.10"],"ghsa_id":"GHSA-777c-2fxx-qr28","id":"tcs_01M5N857XDN2AED0D9YP6XD00N","modified_at":"2026-07-30T18:22:06.281816Z","published_at":"2026-06-15T10:07:17.781Z","references":["https://osv.dev/vulnerability/EEF-CVE-2026-49757","https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-777c-2fxx-qr28","https://cna.erlef.org/cves/CVE-2026-49757.html","https://github.com/team-alembic/ash_authentication/commit/728b8d28c1b5f465fa1116ef044a815300fc733d","https://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14aeb83a77597a0034b7","https://hex.pm/packages/ash_authentication"],"severity":{"label":"critical","score":9.2},"sources":[{"source":"osv","source_id":"EEF-CVE-2026-49757","url":"https://osv.dev/vulnerability/EEF-CVE-2026-49757"},{"source":"nvd","source_id":"CVE-2026-49757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49757"}],"summary":"OAuth2/OIDC account takeover in AshAuthentication via email-based user matching"}