A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+api_documentationUpgrade python3.12-pyjwt+cryptoUpgrade python3-blackUpgrade automation-gatewayUpgrade python3.12-cffiUpgrade automation-gateway-proxy-debugsourceUpgrade python3.12-galaxy-importerUpgrade receptorctlUpgrade automation-hubUpgrade automation-gateway-proxy-server-debuginfoUpgrade python3.12-pyOpenSSLUpgrade automation-gateway-proxyUpgrade automation-controller-cliUpgrade python3.12-pysequoia-debuginfoUpgrade automation-controller-uiUpgrade ansible-lintUpgrade python3.12-django-ansible-base+activitystreamUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-gateway-proxy-serverUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-pulp-containerUpgrade automation-controllerUpgrade python3.12-cryptography-debuginfoUpgrade yamllintUpgrade python3.12-blackUpgrade python3.12-pysequoiaUpgrade python3.12-pytokens-debugsourceUpgrade python3.12-pytokensUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-cryptographyUpgrade automation-controller-serverUpgrade automation-eda-controller-base-servicesUpgrade automation-controller-venv-towerUpgrade python3.12-pyasn1-modulesUpgrade python3.12-pyasn1Upgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-pytokens-debuginfoUpgrade automation-platform-uiUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python-pytokens-debugsourceUpgrade python3-pytokensUpgrade ansible-coreUpgrade python3.12-cffi-debugsourceUpgrade python3.12-pysequoia-debugsourceUpgrade receptorUpgrade python3.12-markdownUpgrade python3-pathspecUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-gateway-serverUpgrade ansible-testUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-pyjwtUpgrade python3.12-pathspecUpgrade python3.12-django-ansible-base+rbacUpgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-jwcryptoUpgrade python3.12-galaxy-ngUpgrade receptor-debugsourceUpgrade python3.12-django-ansible-baseUpgrade python3.12-cryptography-debugsourceUpgrade python3.12-cffi-debuginfoUpgrade python3-pytokens-debuginfoUpgrade automation-eda-controller-baseUpgrade python3.12-pulpcoreUpgrade python3.12-django-ansible-base+authenticationUpgrade python3.12-dynaconfUpgrade python3-wheel-wheelUpgrade automation-eda-controller-worker-servicesUpgrade automation-eda-controller | May 6, 2026 | May 4, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub