CVE-2026-82723
LowCVSS 1.8Summary
A vulnerability in the AshAuthentication library (audit_log add-on) causes the full user record, including the hashed_password attribute, to be stored in the audit log when an audited action is invoked with an actor set. Marking the attribute as sensitive does not help because redaction only applies to inspect/1 output, not JSON encoding or raw-term storage. The issue affects versions from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.
Risk Assessment
Anyone with read access to the audit store (e.g., database credentials, an audit role, a backup, or a log shipper) can obtain password digests for all active accounts and perform offline password attacks. There is no remote attack vector, but the exposure of authentication data poses a serious risk to the organization.
Recommendation
Update the ash_authentication library to version 4.15.0 or 5.0.0-rc.2 (or later); if that is not possible, restrict access to the audit store and consider filtering actor data before storage. Additionally, verify whether existing audit logs already contain stored password digests.
Other vulnerabilities in AshAuthentication
See all- CVE-2026-86522Medium
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
- CVE-2026-82760High
An inefficient algorithmic complexity vulnerability in AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in an API key. The decoding functions have quadratic/cubic complexity and do not limit input length.
- CVE-2026-82759Low
Use of a one-way hash with a predictable salt in team-alembic AshAuthentication allows readers of the audit store to recover client IP addresses that the :hash privacy mode is supposed to pseudonymise. The hash_ip/1 function uses a single unkeyed SHA-256 hash with a salt that defaults to a constant published in the source code, allowing full precomputation of the hash table for the IPv4 address space. Truncation to 16 hex characters does not prevent recovery, and even a properly configured salt can be brute-forced once leaked.
- CVE-2026-82685High
An authorization bypass vulnerability in AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, leading to account takeover. A confirmation token issued for one user is accepted on another user's record.
- CVE-2026-81637Low
An insufficient session expiration flaw in AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign the victim into an attacker-controlled account. The session entry is never removed on failed authentication paths due to improper Elixir scoping, so the CSRF-protection value persists across cancelled or failed attempts until the next request or session expiry.
- CVE-2026-80218High
An improper authentication vulnerability in AshAuthentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user of a different resource. The issue arises from incorrect parsing of the sub claim in the JWT token.
- CVE-2026-78223Medium
Vulnerability in AshAuthentication library (versions from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14) concerning improper verification of cryptographic signature. The token revocation mechanism does not verify signature, allowing an attacker to neutralize revocations or write arbitrary rows into the token resource.
- CVE-2026-86533Critical
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>, but the session readers discard the jti and pass the bare subject, never consulting the revocation record. As a result, a session captured before sign-out keeps working.
- CVE-2026-85500Critical
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. check_user/2 decides whether the require_confirmed_with attribute is set using a bare is_nil(Map.get(user, value)); when the attribute is not loaded it returns %Ash.NotLoaded{} and when a field policy denies it returns %Ash.ForbiddenField{}, neither of which is nil, so the rejection branch is skipped. Additionally, the check is not enforced when the action is invoked directly by an API layer such as AshGraphql or AshJsonApi.
- CVE-2026-82761Critical
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. Nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token. Revocation happens only after JWT verification, and the revocation is written as an upsert, so a concurrent duplicate revocation silently succeeds.
Original NVD description (English source)
Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The audit_log add-on builds each entry's extra_data in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4, which takes :actor from the action callback context verbatim. Any audited action invoked with actor: set to a user record therefore deposits that record, including its hashed_password attribute, into the audit entry. The same module already collapses the audited identity to an opaque string via AshAuthentication.user_to_subject/1 and filters params against the strategy's configured allow-list, so the actor is the only stored value that reaches the audit store unfiltered. Marking the attribute sensitive?: true does not help, because that redacts inspect/1 output rather than JSON encoding or raw-term storage. There is no attacker-controlled trigger and no network disclosure path: entries accumulate from ordinary authenticated activity, and an attacker's own requests deposit only their own digest. Exploitation requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper, at which point the digests support offline password attack against every active account. Whether the material persists depends on the data layer, since raw-term stores keep it verbatim while a SQL store raises Protocol.UndefinedError and drops the entry unless the user resource derives Jason.Encoder. This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.