{"vulnerability": "CVE-2026-49757", "sightings": [{"uuid": "b7b9ed23-15a5-4687-aea2-eab08dee1523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49757", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116755425881916574", "content": "\ud83d\udea8 CRITICAL: CVE-2026-49757 in ash_authentication lets attackers bypass auth by spoofing email in OAuth2/OIDC, risking local account takeover. Patch status unconfirmed \u2014 check vendor advisory. Affected: v0.1.0, 5.0.0-rc.0. https://radar.offseq.com/threat/cve-2026-49757-cwe-290-authentication-bypass-by-sp-5df5a500 #OffSeq #CVE202649757 #OAuth2 #infosec", "creation_timestamp": "2026-06-15T18:00:18.422466Z"}, {"uuid": "79c91906-963c-4123-b8be-7c3d88874c7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49757", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3modf7q5hpd23", "content": "CVE-2026-49757 - OAuth2/OIDC account takeover in AshAuthentication via email-based user matching\nCVE ID : CVE-2026-49757\n \n Published : June 15, 2026, 12:16 p.m. | 52\u00a0minutes ago\n \n Description : Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication...", "creation_timestamp": "2026-06-15T13:27:57.766449Z"}, {"uuid": "42e17bf1-289e-4c6f-b18f-325d9c9cbab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49757", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3modugpemgd2a", "content": "\ud83d\udea8 CRITICAL: team-alembic ash_authentication flaw lets attackers bypass OAuth2/OIDC login with email spoofing \u2014 full account takeover possible! Patch status unconfirmed. Check vendor advisory & avoid email matching for auth. https://radar.offseq.com/threat/cve-2026-49757-cwe-290-authentication-byp...", "creation_timestamp": "2026-06-15T18:00:18.563178Z"}]}