Description
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.

After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.

This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Published: 2026-09-17
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Unauthorized Account Access
Action: Apply Patch
AI Analysis

Impact

After a user signs in with a password, the AshAuthenticationPhoenix component builds a sign‑in URL that includes a fresh single‑use token as a query string. The token is placed in the request line so it is recorded by web servers, reverse proxies, telemetry systems, and the browser history. Anyone with read access to these logs or a user’s browser history can recover the token and authenticate as the user, effectively bypassing the password.

Affected Systems

Team‑Alembic AshAuthentication and AshAuthenticationPhoenix are affected. For AshAuthenticationPhoenix the vulnerable range is 1.7.0 up to but not including 2.17.4, and 3.0.0‑rc.0 up to but not including 3.0.0‑rc.11. For AshAuthentication the vulnerable range is 3.10.5 up to but not including 4.15.0, and 5.0.0‑rc.0 up to but not including 5.0.0‑rc.14.

Risk and Exploitability

The CVSS score indicates a moderate‑to‑high impact (7.2). EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires access to logs or a victim’s browser history; it does not involve remote code execution or open redirects. Attackers can use a captured token to authenticate as the rightful account owner, leading to unauthorized account access.

Generated by OpenCVE AI on September 17, 2026 at 22:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AshAuthenticationPhoenix to a patched version (≥2.17.4 or ≥3.0.0‑rc.11).
  • Upgrade AshAuthentication to a patched version (≥4.15.0 or ≥5.0.0‑rc.14).
  • If an immediate upgrade is not possible, modify the redirect to avoid placing the token in the URL—use a POST request or a temporary server‑side token instead.

Generated by OpenCVE AI on September 17, 2026 at 22:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential. This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Title Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
First Time appeared Team-alembic
Team-alembic ash Authentication
Team-alembic ash Authentication Phoenix
Weaknesses CWE-598
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
Team-alembic ash Authentication Phoenix
References
Metrics cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication Ash Authentication Phoenix
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-17T18:29:20.271Z

Reserved: 2026-09-11T18:45:01.476Z

Link: CVE-2026-81632

cve-icon Vulnrichment

Updated: 2026-09-17T18:29:16.546Z

cve-icon NVD

Status : Received

Published: 2026-09-17T14:17:31.953

Modified: 2026-09-17T19:17:03.560

Link: CVE-2026-81632

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T22:30:17Z

Weaknesses
  • CWE-598

    Use of HTTP Request With Sensitive Query String