pow-auth assent: Identity claim override in Sign in with Apple callback
Summary
The Sign in with Apple strategy of the Elixir authentication library assent merges unverified data from Apple's user callback parameter over the claims of the verified ID token. An attacker with any Apple ID can edit this parameter and replace the subject and email, so the application receives the victim's identity marked as verified. Exploitation requires a Sign in with Apple login through an affected application, and no privileges or user interaction on the victim side.
Affected
- assent from 0.1.25 before 0.3.2 (Hex)
- Git range a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3 to before 18898bde0296152165ae470078490e5798329b1b
- Only applications that use Assent.Strategy.Apple
Fixed in
- Upgrade to assent 0.3.2 or later
Workaround
- Remove the user parameter from the callback parameters before calling Assent.Strategy.Apple.callback/2, for example with Map.delete(params, "user")
- Side effect: the user's name is then unavailable, because Apple delivers it only through this parameter
Exploitation
- No exploitation in the wild known at the time of writing.
- No public proof of concept known at the time of writing.
- Not listed in CISA KEV as far as known.
Our recommendation
- Check whether the application uses assent between 0.1.25 and 0.3.1, for example in mix.lock.
- Upgrade to assent 0.3.2 or later and test the Sign in with Apple login.
- Until the upgrade, do not link or authorize accounts by sub or email from the user parameter.
- Review whether the application relied on the name from the user parameter; after the fix it must be enabled explicitly with include_unverified_name: true and stays unverified.
- Review account logs for unexpected Sign in with Apple logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-117656 CNA record cna.erlef.org
- Fix commit 18898bde (pow-auth/assent) github.com
- Introducing commit a2d331e (pow-auth/assent) github.com
- GitHub Security Advisory GHSA-9fr5-g44g-9526 github.com
- OSV record EEF-CVE-2026-117656 osv.dev
- assent v0.3.2 release notes github.com
- Pull request #207 (pow-auth/assent) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:20.
Original description (NVD)
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker's values. This issue affects assent: from 0.1.25 before 0.3.2.
NVD references (5)
- https://cna.erlef.org/cves/CVE-2026-117656.html
- https://github.com/pow-auth/assent/commit/18898bde0296152165ae470078490e5798329b1b
- https://github.com/pow-auth/assent/commit/a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3
- https://github.com/pow-auth/assent/security/advisories/GHSA-9fr5-g44g-9526
- https://osv.dev/vulnerability/EEF-CVE-2026-117656
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.