AshAuthentication CVE-2026-86522

No authentication and no user interaction required: any attacker who can reach the application's password-reset request action (AshAuthentication.Strategy.Password.RequestPasswordReset) can exploit it against default configurations, provided the application uses the password strategy with password reset enabled. Exploitation requires only that the identity value (email or username) be accepted and reach the vulnerable Logger.warning call before validation, and its practical impact depends on logs being retained/reviewed or fed to a log-processing/SIEM system - hence the vendor's AT:P (an attack requirement beyond the attacker's control). Limiting factors: applications not exposing the password reset flow are unaffected, and the impact is confined to forged/misleading log entries (no confidentiality or availability effect).

This is a genuine but low-severity integrity issue, not a high-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium), reflecting that an unauthenticated remote attacker can trigger it, but the AT:P (attack requirement present) and the impact profile (VI:L/SI:L only; VC:N, VA:N) correctly limit it to log-record integrity - there is no code execution, data theft, or availability loss. No EPSS score, no CISA KEV listing, and no public exploit (PoC) were provided; the only 'source code' supplied is the vendor's own patch commit, not weaponized exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The realistic harm is log forgery/repudiation: an attacker can inject fake log lines with attacker-chosen severity tags to mislead operators, hide activity, or poison downstream log-processing/SIEM pipelines. The signals are internally consistent (low technical impact, no exploitation evidence), so this belongs in routine patch cycles rather than emergency response. Note: the input provides only a CVSS 4.0 vector - no 3.1 vector - and the 'Information Disclosure' tag conflicts with the vector's VC:N (no confidentiality impact), so treat that tag as inaccurate.

An attacker submits a password-reset request whose identity field (email/username) contains embedded newline and control characters plus a forged log line (e.g. a fake '[error]' or '[info]' entry). Because AshAuthentication interpolates this identity directly into a Logger.warning heredoc without escaping, the injected newline terminates the real record and the attacker-controlled text is written as an independent, authentic-looking application log line. No authentication is required and no public exploit code has been identified, but the technique is trivial to reproduce.