CVE-2025-32782: Ash Authentication Bypass Vulnerability

CVE-2025-32782 Overview

CVE-2025-32782 affects Ash Authentication, an authentication library for the Ash framework in Elixir. The vulnerability exists in the account confirmation flow, which relies on a GET request triggered by a link delivered via email. Automated systems such as Outlook, virus scanners, and email link previewers can follow these links without user interaction. This behavior allows an attacker to register an account using another user's email address and have that account auto-confirmed by the victim's mail client. The flaw does not permit takeover of existing accounts or access to private data. Impact is limited to unauthorized confirmation of newly registered accounts. The issue is tracked as [CWE-306] Missing Authentication for Critical Function and is resolved in version 4.7.0.

Critical Impact
Attackers can register accounts under a victim's email address and have those accounts confirmed automatically by email clients or security scanners that prefetch links.

Affected Products

Ash Authentication versions prior to 4.7.0
Applications using the AshAuthentication confirmation add-on
Deployments using AshAuthenticationPhoenix with the default confirmation strategy

Discovery Timeline

2025-04-15 - CVE-2025-32782 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32782

Vulnerability Analysis

The vulnerability is a Business Logic Flaw combined with Missing Authentication for a Critical Function. Ash Authentication's confirmation add-on issues a signed token embedded in a URL and delivered to the user's inbox. Clicking the link submits a GET request that confirms the account and marks the email as verified.

GET requests are considered safe and idempotent by HTTP semantics. Email clients, gateway antivirus engines, and preview services routinely dereference URLs in messages to scan content or generate previews. When one of these systems follows the confirmation link, the server processes the request as if the recipient had explicitly consented. The account transitions to a confirmed state without the user acting.

Root Cause

The confirmation endpoint performs a state-changing operation in response to a GET request and does not require any additional user interaction to complete confirmation. The design assumes only the human recipient will follow the link, which does not hold in modern email ecosystems.

Attack Vector

An attacker registers an account using a victim's email address. The Ash Authentication service sends a confirmation email to the victim. The victim's email client, spam filter, or security appliance follows the link during automated processing. The account is confirmed under the attacker's control while pointing to the victim's email identity. This does not grant access to any existing account belonging to the victim.

text

// Patch snippet: adds require_interaction? option to confirmation add-on
   request_action_name: 1,
   request_password_reset_action_name: 1,
   require_confirmed_with: 1,
+  require_interaction?: 1,
   require_token_presence_for_authentication?: 1,
   resettable: 0,
   resettable: 1,

Source: GitHub Commit 99ea389

Detection Methods for CVE-2025-32782

Indicators of Compromise

Account confirmations completing within seconds of registration, often faster than a human could open the email.
Confirmation request User-Agent headers matching mail security vendors, link scanners, or preview bots rather than end-user browsers.
Multiple confirmations originating from IP ranges belonging to cloud email providers (Microsoft, Google, Proofpoint, Mimecast).

Detection Strategies

Review application logs for GET requests to confirmation endpoints paired with non-browser User-Agent strings.
Correlate account creation events with the source IP and geolocation of the subsequent confirmation click for mismatches.
Flag registrations where the account email domain differs from any organizational identity previously associated with the requester.

Monitoring Recommendations

Instrument the confirmation controller to record HTTP method, headers, and timing between token issuance and consumption.
Alert on bulk registrations targeting the same email domain, which may indicate abuse of the auto-confirm behavior.
Retain authentication telemetry long enough to reconstruct account provenance during incident response.

How to Mitigate CVE-2025-32782

Immediate Actions Required

Upgrade Ash Authentication to version 4.7.0 or later.
Enable the new require_interaction? option on the confirmation strategy so confirmation requires an explicit user action rather than a bare GET.
Audit accounts created before the upgrade and require re-confirmation for any that show signs of automated activation.

Patch Information

The fix ships in Ash Authentication 4.7.0. The commit introduces a require_interaction? configuration flag on the confirmation add-on and adds a corresponding confirm_route for AshAuthenticationPhoenix applications. When enabled, the flow renders a confirmation page requiring a POST or button click, defeating passive link prefetching. See the GitHub Security Advisory GHSA-3988-q8q7-p787 and the remediation commit for details.

Workarounds

If patching is delayed, front the confirmation endpoint with a landing page that requires an explicit POST submission to complete confirmation.
Reject confirmation GET requests from User-Agent strings associated with mail scanners and link previewers until the upgrade is applied.
Reduce token lifetime on confirmation links to shorten the window in which automated systems can trigger confirmation.

elixir

# Configuration example for AshAuthenticationPhoenix after upgrading to 4.7.0
confirm_route(
  MyApp.Accounts.User,
  :confirm_new_user,
  auth_routes_prefix: "/auth",
  overrides: [MyApp.AuthOverrides, AshAuthentication.Phoenix.Overrides.Default]
)