Zero Radar
← feed
CriticalVulnerabilityCVE-2026-117656updated 31 Oct 2026, 00:21 UTC

Assent Sign in with Apple lets attackers impersonate other users

A login library could let someone sign in as another person. An attacker can edit a form field during Apple login so the app believes it is a different user.

Fixed in assent 0.3.2 · out Official source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesassent 0.3.2 · since 31 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker signs inUses their own Apple ID to log in
  2. 2Attacker edits user fieldBrowser submits the modified user parameter
  3. 3Library merges dataUnverified user data overrides verified ID token claims
  4. 4App trusts wrong identityLookup uses attacker's sub or email values
  5. ResultAttacker logs in as another user

What happened

In the assent library's Sign in with Apple strategy, the callback merges unverified user data from a browser-controlled parameter over the claims of the verified ID token, so attacker-supplied sub and email values replace the real ones.

Why it is dangerous: An unauthenticated attacker can take over accounts in apps that look up, link, or authorize users by the returned subject or email. Any app using the affected library's Apple login is at risk.

Are you affected?

You are affected if your app uses the assent Elixir library from version 0.1.25 before 0.3.2 with its Sign in with Apple strategy.

assent (Elixir) from 0.1.25 before 0.3.2

What to do

  1. Update assent to version 0.3.2 or later
  2. Review how your app uses the subject and email returned from Apple login, since these could have been altered before the fix

Timeline

  1. 31 Oct 2026, 00:16 UTC
    Publicly disclosed
  2. 31 Oct 2026, 00:16 UTC
    Reported by NVD · NVD
  3. 31 Oct 2026, 00:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-117656
CVSS
9.3 / 10
Disclosed
31 Oct 2026, 00:16 UTC
On Zero Radar
31 Oct 2026, 00:21 UTC (4 min after disclosure)
Last change
31 Oct 2026, 00:21 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Assent Sign in with Apple lets attackers impersonate other users · Zero Radar