Description
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward.

Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker.

This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.
Published: 2026-10-23
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Secret Key Exposure
Action: Implement Workaround
AI Analysis

Impact

Plug.Crypto performs argument type validation through function-head guards, and a guard failure triggers a FunctionClauseError that includes the exact argument values in the top stack frame. When the provided token or comparison operand is not a binary, the guard fails, and the Erlang VM raises an error that propagates the secret key base, a derived key, or an API key into application logs or error-tracking crash reports. This reveals sensitive configuration values and constitutes a confidentiality violation, described by the CWE‑532 weakness.

Affected Systems

The vulnerability is present in the Elixir Plug library and its plug_crypto submodule. It affects plug versions from 1.6.3 up to, but not including, 1.7.0, and plug_crypto versions from 1.0.0 up to, but not including, 2.2.1. The affected products are identified by the cpe strings for elixir-plug:plug and elixir-plug:plug_crypto.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated remote attacker can trigger the guard failure by sending a wrong-typed parameter; however, the secret is exposed only through logged stack traces or forwarded error reports, so the attacker must have access to application logs or an error‑tracking system that forwards them. The practical threat is limited to environments where logs are centrally monitored or visible to third parties, but the confidentiality impact of leaked secret keys remains significant.

Generated by OpenCVE AI on October 23, 2026 at 11:50 UTC.

Remediation

Vendor Workaround

Check argument types in the calling code before entering Plug.Crypto, so no head guard ever fails. Pass a token to Phoenix.Token.verify/4, Phoenix.Token.decrypt/4, Plug.Crypto.verify/4 or Plug.Crypto.decrypt/4 only when is_binary(token) holds, and treat anything else as an invalid token. Call Plug.Crypto.secure_compare/2 only when both operands are binaries, treating a missing header or parameter as a failed comparison rather than passing nil. Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending vars with the crash report. This narrows exposure but leaves the value in the local error log.

OpenCVE Recommended Actions

  • Validate argument types in all calling code before invoking Plug.Crypto functions, ensuring binary tokens are used and treating non-binary inputs as invalid.
  • Configure error trackers to discard or sanitize stack‑frame arguments so that secrets are not sent in crash reports.
  • Redact or suppress full stack traces in application logs, or otherwise ensure that sensitive values are removed before they are written to persistent storage.

Generated by OpenCVE AI on October 23, 2026 at 11:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Description Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward. Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.
Title Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
First Time appeared Elixir-plug
Elixir-plug plug
Elixir-plug plug Crypto
Weaknesses CWE-532
CPEs cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*
cpe:2.3:a:elixir-plug:plug_crypto:*:*:*:*:*:*:*:*
Vendors & Products Elixir-plug
Elixir-plug plug
Elixir-plug plug Crypto
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Elixir-plug Plug Plug Crypto
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-23T13:39:29.887Z

Reserved: 2026-10-06T10:30:01.805Z

Link: CVE-2026-105963

cve-icon Vulnrichment

Updated: 2026-10-23T13:39:26.992Z

cve-icon NVD

Status : Received

Published: 2026-10-23T10:16:40.880

Modified: 2026-10-23T14:17:30.363

Link: CVE-2026-105963

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T12:00:14Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File