Vulnerability advisory

EEF-CVE-2026-86522

Log injection via an unescaped password reset identity in AshAuthentication

Published Sep 17, 2026Updated Sep 17, 2026OSV record ↗

Also known as CVE-2026-86522GHSA-wg7g-r393-vr3g

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Affected versions

ash_authentication Hex

All ash_authentication advisories →

Affected	Fixed in
`4.2.0` to before 4.15.0	`4.15.0`Advisories →
`5.0.0-rc.0` to before 5.0.0-rc.14	`5.0.0-rc.14`Advisories →
Also listed as affected (95) `4.10.0` `4.11.0` `4.12.0` `4.13.0` `4.13.1` `4.13.2` `4.13.3` `4.13.4` `4.13.5` `4.13.6` `4.13.7` `4.14.0` `4.14.1` `4.14.2` `4.2.0` `4.2.1` `4.2.2` `4.2.3` `4.2.4` `4.2.5` `4.2.6` `4.2.7` `4.3.0` `4.3.1` `4.3.10` `4.3.11` `4.3.12` `4.3.2` `4.3.3` `4.3.4` `4.3.5` `4.3.6` `4.3.7` `4.3.8` `4.3.9` `4.4.0` `4.4.1` `4.4.2` `4.4.3` `4.4.4` `4.4.5` `4.4.6` `4.4.7` `4.4.8` `4.4.9` `4.5.0` `4.5.1` `4.5.2` `4.5.3` `4.5.4` `4.5.5` `4.5.6` `4.6.0` `4.6.1` `4.6.2` `4.6.3` `4.6.4` `4.7.0` `4.7.1` `4.7.2` `4.7.3` `4.7.4` `4.7.5` `4.7.6` `4.8.0` `4.8.1` `4.8.2` `4.8.3` `4.8.5` `4.8.6` `4.8.7` `4.9.0` `4.9.1` `4.9.2` `4.9.3` `4.9.4` `4.9.5` `4.9.6` `4.9.7` `4.9.8` `4.9.9` `5.0.0-rc.0` `5.0.0-rc.1` `5.0.0-rc.10` `5.0.0-rc.11` `5.0.0-rc.12` `5.0.0-rc.13` `5.0.0-rc.2` `5.0.0-rc.3` `5.0.0-rc.4` `5.0.0-rc.5` `5.0.0-rc.6` `5.0.0-rc.7` `5.0.0-rc.8` `5.0.0-rc.9`

Repository

Affected commits	Fixed by commit
GIT github.com/team-alembic/ash_authentication ↗
3954f277929712755aef57a4a3a821688f121316 to before fd19358bf0eee53ef13dcf17cc499bd4fb393981	`fd19358bf0eee53ef13dcf17cc499bd4fb393981`
Not specified	`57c7cc3236bef0fa9da19cb315414f216488866d`
Also listed as affected (90) `v4.14.2` `v5.0.0-rc.13` `v4.14.1` `v5.0.0-rc.12` `v5.0.0-rc.11` `v5.0.0-rc.10` `v4.14.0` `v4.13.7` `5.0.0-rc.9` `5.0.0-rc.8` `v5.0.0-rc.7` `v5.0.0-rc.6` `v5.0.0-rc.5` `v5.0.0-rc.4` `v5.0.0-rc.3` `v5.0.0-rc.2` `v5.0.0-rc.1` `v5.0.0-rc.0` `v4.13.6` `v4.13.5` `v4.13.4` `v4.13.3` `v4.13.2` `v4.13.1` `v4.13.0` `v4.12.0` `v4.11.0` `v4.10.0` `v4.9.9` `v4.9.8` `v4.9.7` `v4.9.6` `v4.9.5` `v4.9.4` `v4.9.3` `v4.9.2` `v4.9.1` `v4.9.0` `v4.8.7` `v4.8.5` `v4.8.4` `v4.8.3` `v4.8.2` `v4.8.1` `v4.8.0` `v4.7.7` `v4.7.6` `v4.7.5` `v4.7.4` `v4.7.3` `v4.7.2` `v4.7.1` `v4.7.0` `v4.6.4` `v4.6.3` `v4.6.2` `v4.6.1` `v4.6.0` `v4.5.6` `v4.5.5` `v4.5.4` `v4.5.3` `v4.5.2` `v4.5.1` `v4.4.9` `v4.4.8` `v4.4.7` `v4.4.6` `v4.4.5` `v4.4.4` `v4.4.3` `v4.4.2` `v4.4.1` `v4.4.0` `v4.3.12` `v4.3.10` `v4.3.9` `v4.3.7` `v4.3.6` `v4.3.4` `v4.3.3` `v4.3.2` `v4.3.1` `v4.3.0` `v4.2.7` `v4.2.5` `v4.2.3` `v4.2.2` `v4.2.1` `v4.2.0`

Description

Summary

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters.

AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application.

This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.