EUVD-2026-81485Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L and PR:L because the attacker must read log/proxy/history stores they already have access to; AC:H for the single-use token validity/timing window; C:H/I:H account takeover, A:N.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
5DescriptionCVE.org
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.
After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.
This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.11, with the companion ash_authentication 3.10.5 to <4.15.0 and 5.0.0-rc.0 to <5.0.0-rc.14) places a freshly issued single-use sign-in token in the query string of a GET redirect to the sign_in_with_token route, so the live credential is written into the request line where it is retained by web server access logs, reverse-proxy logs, request telemetry and the victim's browser history. Anyone who can read those artifacts - and can replay the token before the legitimate redirect consumes it or it expires - can authenticate as the affected user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the application to use AshAuthentication.Phoenix password sign-in with sign_in_tokens_enabled? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor rates this CVSS 4.0 7.2 (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H), and the key metrics are internally consistent with a credential-leak-via-logs weakness (CWE-598) rather than a remotely-triggerable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-fixed releases: ash_authentication_phoenix 2.17.4 or later on the 2.x line (or 3.0.0-rc.11 or later on the 3.0 release-candidate line) and ash_authentication 4.15.0 or later on the 4.x line (or 5.0.0-rc.14 or later on the 5.0 line); these correspond to the upstream patch commits referenced for both packages and are documented in GHSA-8jh5-339h-mqx9 and GHSA-j726-59hm-r46r, with the CNA record at https://cna.erlef.org/cves/CVE-2026-81632.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using ash_authentication_phoenix and ash_authentication to confirm whether they fall in the affected ranges (ash_authentication_phoenix 1.7.0 to <2.17.4 or 3.0.0-rc.0 to <3.0.0-rc.11, with ash_authentication 3.10.5 to <4.15.0 or 5.0.0-rc.0 to <5.0.0-rc.14) and whether sign_in_tokens_enabled? …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoen
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity c
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust ser
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Share
External POC / Exploit Code
Leaving vuln.today