ash_authentication has email link auto-click account confirmation vulnerability
Date: 2025-04
Affected: erlang/ash_authentication
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-32782
CWE: CWE-306
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

### Impact The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools (e.g., Outlook, virus scanners, and email previewers) may automatically follow these links, unintentionally confirming the account. This allows an attacker to register an account using another user’s email and potentially have it auto-confirmed by the victim’s email client. This does not allow attackers to take over or access existing accounts or private data. It is limited to account confirmation of new accounts only. ### Patches A mitigation has been released in version `4.7.0`. You will also need to upgrade to `2.6.0` or later of `ash_authentication_phoenix` to take advantage of the autogenerated views for confirmation. The fix updates the confirmation flow to require explicit user interaction (such as clicking a button on the confirmation page) rather than performing the confirmation via a GET request. This ensures that automatic link prefetching or scanning by email clients does not unintentionally confirm accounts. To mitigate, follow these steps: 1. Upgrade `ash_authentication` >= `4.7.0` 2. Upgrade `ash_authentication_phoenix` >= `2.6.0` (if using `ash_authentication_phoenix`) 3. Set `require_interaction? true` in your confirmation strategy. 4. Add `confirm_route` to your router, if using `ash_authentication_phoenix` *above* `auth_routes`. #### Setting `require_interaction? true` modify your `confi


Mitigations:

Architectural layers (MAESTRO):