Skip to content
Fencer Vulns
medium 6.3

CVE-2026-86522 json

Log injection via an unescaped password reset identity in AshAuthentication

published 2026-09-17 52 d ago modified 2026-09-18 51 d ago also EEF-CVE-2026-86522 , GHSA-wg7g-r393-vr3g , EUVD-2026-81482

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters.

AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application.

This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Patch / fix

  • hex ash_authentication 4.15.0, 5.0.0-rc.14
  • team-alembic ash_authentication 4.15.0, 5.0.0-rc.14

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
52 d ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
hex ash_authentication
>=4.2.0, <4.15.0
>=5.0.0-rc.0, <5.0.0-rc.14
4.15.0
5.0.0-rc.14

Affected products

  • team-alembic ash_authentication

Classification

Weakness
  • CWE-117 Improper Output Neutralization for Logs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.