EEF-CVE-2026-81632 CVE-2026-81632 GHSA-8jh5-339h-mqx9
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.21%
- Chance of exploitation in the next 30 days. Higher than 11.39% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-598 Use of HTTP Request With Sensitive Query String
- Fix
- Available
- 2 packages have a fixed version
Description
Summary
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.
After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.
This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_authentication | >= 3.10.5, < 4.15.0>= 5.0.0-rc.0, < 5.0.0-rc.14 |
4.15.05.0.0-rc.14 |
| ash_authentication_phoenix | >= 1.7.0, < 2.17.4>= 3.0.0-rc.0, < 3.0.0-rc.11 |
2.17.43.0.0-rc.11 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_authentication Hex → 5.0.0-rc.14
- mix
{:ash_authentication, "~> 5.0.0-rc.14"} # then: mix deps.update ash_authentication
ash_authentication_phoenix Hex → 3.0.0-rc.11
- mix
{:ash_authentication_phoenix, "~> 3.0.0-rc.11"} # then: mix deps.update ash_authentication_phoenix
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-598: Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
How to prevent it
- Implementation: When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
References
Advisories
Fixes and patches
- github.com/team-alembic/ash_authentication_phoenix/commit/920257d0460b9c7cbb42a…
- github.com/team-alembic/ash_authentication_phoenix/commit/ff5ad8737748afed9cdfd…
- github.com/team-alembic/ash_authentication/commit/bbf345c1bb7aa28bce5dd856ac0ed…
- github.com/team-alembic/ash_authentication/commit/8d8ddd25c69b669a92a701af74bff…
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-86533 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication | Not rated yet | Also affects ash_authentication |
| EEF-CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication | Not rated yet | Also affects ash_authentication |
Credits: James Harton, Jonatan Männchen / EEF, Peter Ullrich
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor