CVE-2026-78223

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

An inefficient algorithmic complexity vulnerability in AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in an API key. The decoding functions have quadratic/cubic complexity and do not limit input length.

Use of a one-way hash with a predictable salt in team-alembic AshAuthentication allows readers of the audit store to recover client IP addresses that the :hash privacy mode is supposed to pseudonymise. The hash_ip/1 function uses a single unkeyed SHA-256 hash with a salt that defaults to a constant published in the source code, allowing full precomputation of the hash table for the IPv4 address space. Truncation to 16 hex characters does not prevent recovery, and even a properly configured salt can be brute-forced once leaked.

A vulnerability in the AshAuthentication library (audit_log add-on) causes the full user record, including the hashed_password attribute, to be stored in the audit log when an audited action is invoked with an actor set. Marking the attribute as sensitive does not help because redaction only applies to inspect/1 output, not JSON encoding or raw-term storage. The issue affects versions from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.

An authorization bypass vulnerability in AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, leading to account takeover. A confirmation token issued for one user is accepted on another user's record.

An insufficient session expiration flaw in AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign the victim into an attacker-controlled account. The session entry is never removed on failed authentication paths due to improper Elixir scoping, so the CSRF-protection value persists across cancelled or failed attempts until the next request or session expiry.

An improper authentication vulnerability in AshAuthentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user of a different resource. The issue arises from incorrect parsing of the sub claim in the JWT token.

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>, but the session readers discard the jti and pass the bare subject, never consulting the revocation record. As a result, a session captured before sign-out keeps working.

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. check_user/2 decides whether the require_confirmed_with attribute is set using a bare is_nil(Map.get(user, value)); when the attribute is not loaded it returns %Ash.NotLoaded{} and when a field policy denies it returns %Ash.ForbiddenField{}, neither of which is nil, so the rejection branch is skipped. Additionally, the check is not enforced when the action is invoked directly by an API layer such as AshGraphql or AshJsonApi.

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. Nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token. Revocation happens only after JWT verification, and the revocation is written as an upsert, so a concurrent duplicate revocation silently succeeds.