CVE-2026-81632highCWE-598

CVE-2026-81632: falha de alta gravidade em team-alembic ash_authentication

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Publicada em

Seguir esta CVE+ Monitorar ash authentication+ Monitorar ash authentication phoenix

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.2%
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential. This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
team-alembic · ash_authenticationteam-alembic · ash_authentication_phoenix
CVEs relacionadas — team-alembic ash_authentication

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86533CRITICALRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEPSS 0.9%CVE-2026-76949CRITICALRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementEPSS 0.8%CVE-2026-85500CRITICAL`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationEPSS 0.8%CVE-2026-66882LOWReflected XSS in AshAuthentication confirmation and magic link interaction formsEPSS 0.8%CVE-2026-88952CRITICALOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationEPSS 0.7%CVE-2026-86688HIGHSession id is not renewed on authentication in ash_authentication, allowing session fixationEPSS 0.7%