{ "affected": [ { "database_specific": { "source": "https://cna.erlef.org/osv/EEF-CVE-2026-81632.json" }, "package": { "ecosystem": "Hex", "name": "ash_authentication_phoenix", "purl": "pkg:hex/ash_authentication_phoenix" }, "ranges": [ { "events": [ { "introduced": "1.7.0" }, { "fixed": "2.17.4" } ], "type": "SEMVER" }, { "events": [ { "introduced": "3.0.0-rc.0" }, { "fixed": "3.0.0-rc.11" } ], "type": "SEMVER" } ], "versions": [ "1.7.0", "1.7.1", "1.7.2", "1.7.3", "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1", "1.9.2", "1.9.3", "1.9.4", "2.0.0", "2.0.0-rc.0", "2.0.0-rc.1", "2.0.0-rc.2", "2.0.1", "2.0.2", "2.1.0", "2.1.1", "2.1.10", "2.1.11", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.1.6", "2.1.7", "2.1.8", "2.1.9", "2.10.0", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.12.0", "2.12.1", "2.12.2", "2.13.0", "2.13.1", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.17.3", "2.2.0", "2.2.1", "2.3.0", "2.4.0", "2.4.1", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.6", "2.4.7", "2.4.8", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.6.0", "2.6.1", "2.6.2", "2.6.3", "2.7.0", "2.8.0", "2.9.0", "3.0.0-rc.0", "3.0.0-rc.1", "3.0.0-rc.10", "3.0.0-rc.2", "3.0.0-rc.3", "3.0.0-rc.4", "3.0.0-rc.6", "3.0.0-rc.7", "3.0.0-rc.8", "3.0.0-rc.9" ] }, { "database_specific": { "source": "https://cna.erlef.org/osv/EEF-CVE-2026-81632.json" }, "package": { "ecosystem": "Hex", "name": "ash_authentication", "purl": "pkg:hex/ash_authentication" }, "ranges": [ { "events": [ { "introduced": "3.10.5" }, { "fixed": "4.15.0" } ], "type": "SEMVER" }, { "events": [ { "introduced": "5.0.0-rc.0" }, { "fixed": "5.0.0-rc.14" } ], "type": "SEMVER" } ], "versions": [ "3.10.5", "3.10.6", "3.10.7", "3.10.8", "3.11.0", "3.11.1", "3.11.10", "3.11.11", "3.11.12", "3.11.13", "3.11.14", "3.11.15", "3.11.16", "3.11.2", "3.11.3", "3.11.4", "3.11.5", "3.11.6", "3.11.7", "3.11.8", "3.11.9", "3.12.0", "3.12.1", "3.12.2", "3.12.3", "3.12.4", "4.0.0", "4.0.0-rc.0", "4.0.0-rc.1", "4.0.0-rc.2", "4.0.0-rc.3", "4.0.0-rc.5", "4.0.0-rc.6", "4.0.1", "4.0.2", "4.0.3", "4.0.4", "4.1.0", "4.10.0", "4.11.0", "4.12.0", "4.13.0", "4.13.1", "4.13.2", "4.13.3", "4.13.4", "4.13.5", "4.13.6", "4.13.7", "4.14.0", "4.14.1", "4.14.2", "4.2.0", "4.2.1", "4.2.2", "4.2.3", "4.2.4", "4.2.5", "4.2.6", "4.2.7", "4.3.0", "4.3.1", "4.3.10", "4.3.11", "4.3.12", "4.3.2", "4.3.3", "4.3.4", "4.3.5", "4.3.6", "4.3.7", "4.3.8", "4.3.9", "4.4.0", "4.4.1", "4.4.2", "4.4.3", "4.4.4", "4.4.5", "4.4.6", "4.4.7", "4.4.8", "4.4.9", "4.5.0", "4.5.1", "4.5.2", "4.5.3", "4.5.4", "4.5.5", "4.5.6", "4.6.0", "4.6.1", "4.6.2", "4.6.3", "4.6.4", "4.7.0", "4.7.1", "4.7.2", "4.7.3", "4.7.4", "4.7.5", "4.7.6", "4.8.0", "4.8.1", "4.8.2", "4.8.3", "4.8.5", "4.8.6", "4.8.7", "4.9.0", "4.9.1", "4.9.2", "4.9.3", "4.9.4", "4.9.5", "4.9.6", "4.9.7", "4.9.8", "4.9.9", "5.0.0-rc.0", "5.0.0-rc.1", "5.0.0-rc.10", "5.0.0-rc.11", "5.0.0-rc.12", "5.0.0-rc.13", "5.0.0-rc.2", "5.0.0-rc.3", "5.0.0-rc.4", "5.0.0-rc.5", "5.0.0-rc.6", "5.0.0-rc.7", "5.0.0-rc.8", "5.0.0-rc.9" ] }, { "database_specific": { "source": "https://cna.erlef.org/osv/EEF-CVE-2026-81632.json" }, "ranges": [ { "events": [ { "introduced": "903f3a386e1aba2f7b070187ef6f31215a92bdfd" }, { "fixed": "920257d0460b9c7cbb42a83d0888c10f4eeeb88a" }, { "fixed": "ff5ad8737748afed9cdfde3ec3a05b8a4702a742" } ], "repo": "https://github.com/team-alembic/ash_authentication_phoenix", "type": "GIT" } ], "versions": [ "v2.17.3", "v3.0.0-rc.10", "v2.17.2", "v3.0.0-rc.9", "v2.17.1", "3.0.0-rc.8", "2.17.0", "v3.0.0-rc.7", "v2.16.0", "v3.0.0-rc.6", "v3.0.0-rc.4", "v3.0.0-rc.3", "3.0.0-rc.3", "v3.0.0-rc.1", "v2.15.0", "v3.0.0-rc.0", "v2.14.1", "v2.14.0", "v2.13.1", "v2.13.0", "v2.12.2", "v2.12.1", "v2.12.0", "v2.11.0", "v2.10.5", "v2.10.4", "v2.10.3", "v2.10.2", "v2.10.1", "v2.10.0", "v2.9.0", "v2.7.0", "v2.6.3", "v2.6.2", "v2.6.1", "v2.6.0", "v2.5.4", "v2.5.3", "v2.5.2", "v2.5.1", "v2.5.0", "v2.4.8", "v2.4.7", "v2.4.6", "v2.4.5", "v2.4.4", "v2.4.3", "v2.4.2", "v2.4.1", "v2.4.0", "v2.3.0", "v2.2.1", "v2.2.0", "v2.1.11", "v2.1.10", "v2.1.9", "v2.1.8", "v2.1.7", "v2.1.6", "v2.1.5", "v2.1.4", "v2.1.3", "v2.1.2", "v2.1.1", "v2.1.0", "v2.0.2", "v2.0.1", "v2.0.0", "v2.0.0-rc.3", "v2.0.0-rc.2", "v2.0.0-rc.1", "v2.0.0-rc.0", "v1.9.4", "v1.9.2", "v1.9.1", "v1.9.0", "v1.8.7", "v1.8.6", "v1.8.5", "v1.8.4", "v1.8.3", "v1.8.2", "v1.8.1", "v1.8.0", "v1.7.3", "v1.7.2", "v1.7.1", "v1.7.0" ] }, { "database_specific": { "source": "https://cna.erlef.org/osv/EEF-CVE-2026-81632.json" }, "ranges": [ { "events": [ { "introduced": "eca8cadea0f1595ed2c10a0c177b1da9aa9e5269" }, { "fixed": "bbf345c1bb7aa28bce5dd856ac0ed2427f103859" }, { "fixed": "8d8ddd25c69b669a92a701af74bff42e1aada998" } ], "repo": "https://github.com/team-alembic/ash_authentication", "type": "GIT" } ], "versions": [ "v4.14.2", "v5.0.0-rc.13", "v4.14.1", "v5.0.0-rc.12", "v5.0.0-rc.11", "v5.0.0-rc.10", "v4.14.0", "v4.13.7", "5.0.0-rc.9", "5.0.0-rc.8", "v5.0.0-rc.7", "v5.0.0-rc.6", "v5.0.0-rc.5", "v5.0.0-rc.4", "v5.0.0-rc.3", "v5.0.0-rc.2", "v5.0.0-rc.1", "v5.0.0-rc.0", "v4.13.6", "v4.13.5", "v4.13.4", "v4.13.3", "v4.13.2", "v4.13.1", "v4.13.0", "v4.12.0", "v4.11.0", "v4.10.0", "v4.9.9", "v4.9.8", "v4.9.7", "v4.9.6", "v4.9.5", "v4.9.4", "v4.9.3", "v4.9.2", "v4.9.1", "v4.9.0", "v4.8.7", "v4.8.5", "v4.8.4", "v4.8.3", "v4.8.2", "v4.8.1", "v4.8.0", "v4.7.7", "v4.7.6", "v4.7.5", "v4.7.4", "v4.7.3", "v4.7.2", "v4.7.1", "v4.7.0", "v4.6.4", "v4.6.3", "v4.6.2", "v4.6.1", "v4.6.0", "v4.5.6", "v4.5.5", "v4.5.4", "v4.5.3", "v4.5.2", "v4.5.1", "v4.4.9", "v4.4.8", "v4.4.7", "v4.4.6", "v4.4.5", "v4.4.4", "v4.4.3", "v4.4.2", "v4.4.1", "v4.4.0", "v4.3.12", "v4.3.10", "v4.3.9", "v4.3.7", "v4.3.6", "v4.3.4", "v4.3.3", "v4.3.2", "v4.3.1", "v4.3.0", "v4.2.7", "v4.2.5", "v4.2.3", "v4.2.2", "v4.2.1", "v4.2.0", "v4.1.0", "v4.0.4", "v4.0.3", "v4.0.2", "v4.0.1", "v4.0.0", "v4.0.0-rc.7", "v4.0.0-rc.6", "v4.0.0-rc.5", "v4.0.0-rc.4", "v4.0.0-rc.3", "v4.0.0-rc.2", "v4.0.0-rc.1", "v4.0.0-rc.0", "v3.12.4", "v3.12.3", "v3.12.2", "v3.12.1", "v3.12.0", "v3.11.16", "v3.11.15", "v3.11.14", "v3.11.13", "v3.11.12", "v3.11.10", "v3.11.9", "v3.11.8", "v3.11.7", "v3.11.6", "v3.11.5", "v3.11.4", "v3.11.3", "v3.11.2", "v3.11.1", "v3.11.0", "v3.10.8", "v3.10.7", "v3.10.6", "v3.10.5" ] } ], "aliases": [ "CVE-2026-81632", "GHSA-8jh5-339h-mqx9" ], "credits": [ { "name": "Peter Ullrich", "type": "REPORTER" }, { "name": "Jonatan Männchen / EEF", "type": "ANALYST" }, { "name": "James Harton", "type": "REMEDIATION_DEVELOPER" } ], "database_specific": { "capec_ids": [ "CAPEC-150" ], "cpe_ids": [ "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*", "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-598" ] }, "details": "## Summary\n\nUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\n\nAfter a successful password sign-in, `AshAuthentication.Phoenix.Components.Password.SignInForm` builds the `sign_in_with_token` path with the freshly issued `user.__metadata__.token` as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\n\nThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.", "id": "EEF-CVE-2026-81632", "modified": "2026-09-17T13:26:04.140685335Z", "published": "2026-09-17T13:09:31.601Z", "references": [ { "type": "ADVISORY", "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-8jh5-339h-mqx9" }, { "type": "WEB", "url": "https://cna.erlef.org/cves/CVE-2026-81632.html" }, { "type": "ADVISORY", "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j726-59hm-r46r" }, { "type": "WEB", "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/903f3a386e1aba2f7b070187ef6f31215a92bdfd" }, { "type": "FIX", "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/920257d0460b9c7cbb42a83d0888c10f4eeeb88a" }, { "type": "FIX", "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/ff5ad8737748afed9cdfde3ec3a05b8a4702a742" }, { "type": "WEB", "url": "https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269" }, { "type": "FIX", "url": "https://github.com/team-alembic/ash_authentication/commit/bbf345c1bb7aa28bce5dd856ac0ed2427f103859" }, { "type": "FIX", "url": "https://github.com/team-alembic/ash_authentication/commit/8d8ddd25c69b669a92a701af74bff42e1aada998" }, { "type": "PACKAGE", "url": "https://hex.pm/packages/ash_authentication_phoenix" }, { "type": "PACKAGE", "url": "https://hex.pm/packages/ash_authentication" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix" }