CVE-2026-117656: impersonation in Sign in with Apple

Critical CVSS 9.3 vulnerability in pow-auth assent enables user impersonation via Sign in with Apple.

CVE-2026-117656 is an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in pow-auth assent's Sign in with Apple strategy. The 'user' parameter in the callback is browser-controlled but accepted as trusted, then merged with verified ID token claims. An attacker can overwrite critical claims like subject and email by modifying this parameter after authenticating with their own Apple ID. Applications authorizing accounts based on returned values are vulnerable to full impersonation.

CVSS 9.3 (Critical). The attack requires no initial authentication. CVE published October 31, 2026. Patch available in assent 0.3.2 and later. Three social media posts in the last 24 hours indicate rising awareness in the developer community. No verified signals of publicly exploited vulnerabilities at publication time.

Update immediately to version 0.3.2 or later. If immediate update is not feasible, review authentication logs for anomalous login patterns. Ensure authorization mechanisms do not depend solely on unvalidated subject or email. Verify authorization against trusted server-side data. Revoke suspicious sessions.

At a glance

What: Acceptance of Extraneous Untrusted Data vulnerability in pow-auth assent's Sign in with Apple strategy. The 'user' parameter in the authentication callback is client-controlled but accepted as trusted, allowing it to overwrite critical claims such as 'sub' (subject) and email. An attacker completes authentication with their own Apple ID and modifies the parameter to impersonate another user.
Severity: CVSS 9.3 (Critical). Allows an unauthenticated attacker to impersonate any user. Applications authorizing accounts based on returned subject or email risk unauthorized access and immediate account takeover.
Affected versions: assent from 0.1.25 before 0.3.2. All versions in this range are exposed.
Fix: Update to pow-auth assent 0.3.2 or later. The patched version validates the 'user' parameter against the verified ID token and rejects unverified claims.
Status: CVE published October 31, 2026. Patch available in version 0.3.2. Three social media posts in the last 24 hours indicate rising awareness in the developer community (unverified signals). No confirmed public exploit signals.
Action: Priority update to version 0.3.2 or later. Review authentication logs for anomalous patterns. Verify that account authorization does not depend solely on unvalidated subject or email. Revoke suspicious sessions if necessary.

Sources: NVD, CVE-2026-117656

← All articles