EEF-CVE-2026-86522

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-86522.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-86522.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-86522
Aliases
  • CVE-2026-86522
  • GHSA-wg7g-r393-vr3g
Published
2026-09-17T13:09:11Z
Modified
2026-09-17T13:26:03Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Log injection via an unescaped password reset identity in AshAuthentication
Details

Summary

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters.

AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application.

This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Database specific 
{
    "capec_ids": [
        "CAPEC-93"
    ],
    "cpe_ids": [
        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-117"
    ]
}
References
Credits
    • Peter Ullrich - REPORTER
    • Jonatan Männchen / EEF - ANALYST
    • James Harton - REMEDIATION_DEVELOPER

Affected packages

Hex / ash_authentication

Package

Name
ash_authentication
Purl
pkg:hex/ash_authentication

Affected ranges

Type
SEMVER
Events
Introduced
4.2.0
Fixed
4.15.0
Type
SEMVER
Events
Introduced
5.0.0-rc.0
Fixed
5.0.0-rc.14

Affected versions

4.*
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.3.12
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.8.0
4.8.1
4.8.2
4.8.3
4.8.5
4.8.6
4.8.7
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
4.10.0
4.11.0
4.12.0
4.13.0
4.13.1
4.13.2
4.13.3
4.13.4
4.13.5
4.13.6
4.13.7
4.14.0
4.14.1
4.14.2
5.*
5.0.0-rc.0
5.0.0-rc.1
5.0.0-rc.2
5.0.0-rc.3
5.0.0-rc.4
5.0.0-rc.5
5.0.0-rc.6
5.0.0-rc.7
5.0.0-rc.8
5.0.0-rc.9
5.0.0-rc.10
5.0.0-rc.11
5.0.0-rc.12
5.0.0-rc.13

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-86522.json"

Git / github.com/team-alembic/ash_authentication

Affected ranges

Type
GIT
Repo
https://github.com/team-alembic/ash_authentication
Events
Introduced
3954f277929712755aef57a4a3a821688f121316
Fixed
fd19358bf0eee53ef13dcf17cc499bd4fb393981
Fixed
57c7cc3236bef0fa9da19cb315414f216488866d

Affected versions

5.*
5.0.0-rc.8
5.0.0-rc.9
v4.*
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.13.1
v4.13.2
v4.13.3
v4.13.4
v4.13.5
v4.13.6
v4.13.7
v4.14.0
v4.14.1
v4.14.2
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.5
v4.2.7
v4.3.0
v4.3.1
v4.3.10
v4.3.12
v4.3.2
v4.3.3
v4.3.4
v4.3.6
v4.3.7
v4.3.9
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.4.9
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.6
v4.7.7
v4.8.0
v4.8.1
v4.8.2
v4.8.3
v4.8.4
v4.8.5
v4.8.7
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5
v4.9.6
v4.9.7
v4.9.8
v4.9.9
v5.*
v5.0.0-rc.0
v5.0.0-rc.1
v5.0.0-rc.10
v5.0.0-rc.11
v5.0.0-rc.12
v5.0.0-rc.13
v5.0.0-rc.2
v5.0.0-rc.3
v5.0.0-rc.4
v5.0.0-rc.5
v5.0.0-rc.6
v5.0.0-rc.7

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-86522.json"