EEF-CVE-2026-81632

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-81632.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-81632.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-81632
Aliases
  • CVE-2026-81632
  • GHSA-8jh5-339h-mqx9
Published
2026-09-17T13:09:31Z
Modified
2026-09-17T13:26:04Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Details

Summary

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.

After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.

This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Database specific 
{
    "capec_ids": [
        "CAPEC-150"
    ],
    "cpe_ids": [
        "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-598"
    ]
}
References
Credits
    • Peter Ullrich - REPORTER
    • Jonatan Männchen / EEF - ANALYST
    • James Harton - REMEDIATION_DEVELOPER

Affected packages

Hex
ash_authentication_phoenix

Package

Name
ash_authentication_phoenix
Purl
pkg:hex/ash_authentication_phoenix

Affected ranges

Type
SEMVER
Events
Introduced
1.7.0
Fixed
2.17.4
Type
SEMVER
Events
Introduced
3.0.0-rc.0
Fixed
3.0.0-rc.11

Affected versions

1.*
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.*
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.*
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
3.0.0-rc.10

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-81632.json"
ash_authentication

Package

Name
ash_authentication
Purl
pkg:hex/ash_authentication

Affected ranges

Type
SEMVER
Events
Introduced
3.10.5
Fixed
4.15.0
Type
SEMVER
Events
Introduced
5.0.0-rc.0
Fixed
5.0.0-rc.14

Affected versions

3.*
3.10.5
3.10.6
3.10.7
3.10.8
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.11.8
3.11.9
3.11.10
3.11.11
3.11.12
3.11.13
3.11.14
3.11.15
3.11.16
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
4.*
4.0.0-rc.0
4.0.0-rc.1
4.0.0-rc.2
4.0.0-rc.3
4.0.0-rc.5
4.0.0-rc.6
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.3.12
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.8.0
4.8.1
4.8.2
4.8.3
4.8.5
4.8.6
4.8.7
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
4.10.0
4.11.0
4.12.0
4.13.0
4.13.1
4.13.2
4.13.3
4.13.4
4.13.5
4.13.6
4.13.7
4.14.0
4.14.1
4.14.2
5.*
5.0.0-rc.0
5.0.0-rc.1
5.0.0-rc.2
5.0.0-rc.3
5.0.0-rc.4
5.0.0-rc.5
5.0.0-rc.6
5.0.0-rc.7
5.0.0-rc.8
5.0.0-rc.9
5.0.0-rc.10
5.0.0-rc.11
5.0.0-rc.12
5.0.0-rc.13

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-81632.json"
Git
github.com/team-alembic/ash_authentication_phoenix

Affected ranges

Type
GIT
Repo
https://github.com/team-alembic/ash_authentication_phoenix
Events
Introduced
903f3a386e1aba2f7b070187ef6f31215a92bdfd
Fixed
920257d0460b9c7cbb42a83d0888c10f4eeeb88a
Fixed
ff5ad8737748afed9cdfde3ec3a05b8a4702a742

Affected versions

2.*
2.17.0
3.*
3.0.0-rc.3
3.0.0-rc.8
v1.*
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.9.0
v1.9.1
v1.9.2
v1.9.4
v2.*
v2.0.0
v2.0.0-rc.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.3
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.1.10
v2.1.11
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.11.0
v2.12.0
v2.12.1
v2.12.2
v2.13.0
v2.13.1
v2.14.0
v2.14.1
v2.15.0
v2.16.0
v2.17.1
v2.17.2
v2.17.3
v2.2.0
v2.2.1
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.7.0
v2.9.0
v3.*
v3.0.0-rc.0
v3.0.0-rc.1
v3.0.0-rc.10
v3.0.0-rc.3
v3.0.0-rc.4
v3.0.0-rc.6
v3.0.0-rc.7
v3.0.0-rc.9

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-81632.json"
github.com/team-alembic/ash_authentication

Affected ranges

Type
GIT
Repo
https://github.com/team-alembic/ash_authentication
Events
Introduced
eca8cadea0f1595ed2c10a0c177b1da9aa9e5269
Fixed
bbf345c1bb7aa28bce5dd856ac0ed2427f103859
Fixed
8d8ddd25c69b669a92a701af74bff42e1aada998

Affected versions

5.*
5.0.0-rc.8
5.0.0-rc.9
v3.*
v3.10.5
v3.10.6
v3.10.7
v3.10.8
v3.11.0
v3.11.1
v3.11.10
v3.11.12
v3.11.13
v3.11.14
v3.11.15
v3.11.16
v3.11.2
v3.11.3
v3.11.4
v3.11.5
v3.11.6
v3.11.7
v3.11.8
v3.11.9
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v4.*
v4.0.0
v4.0.0-rc.0
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.0-rc.4
v4.0.0-rc.5
v4.0.0-rc.6
v4.0.0-rc.7
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.13.1
v4.13.2
v4.13.3
v4.13.4
v4.13.5
v4.13.6
v4.13.7
v4.14.0
v4.14.1
v4.14.2
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.5
v4.2.7
v4.3.0
v4.3.1
v4.3.10
v4.3.12
v4.3.2
v4.3.3
v4.3.4
v4.3.6
v4.3.7
v4.3.9
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.4.9
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.6
v4.7.7
v4.8.0
v4.8.1
v4.8.2
v4.8.3
v4.8.4
v4.8.5
v4.8.7
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5
v4.9.6
v4.9.7
v4.9.8
v4.9.9
v5.*
v5.0.0-rc.0
v5.0.0-rc.1
v5.0.0-rc.10
v5.0.0-rc.11
v5.0.0-rc.12
v5.0.0-rc.13
v5.0.0-rc.2
v5.0.0-rc.3
v5.0.0-rc.4
v5.0.0-rc.5
v5.0.0-rc.6
v5.0.0-rc.7

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-81632.json"