Description
Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store.

The audit_log add-on builds each entry's extra_data in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4, which takes :actor from the action callback context verbatim. Any audited action invoked with actor: set to a user record therefore deposits that record, including its hashed_password attribute, into the audit entry. The same module already collapses the audited identity to an opaque string via AshAuthentication.user_to_subject/1 and filters params against the strategy's configured allow-list, so the actor is the only stored value that reaches the audit store unfiltered. Marking the attribute sensitive?: true does not help, because that redacts inspect/1 output rather than JSON encoding or raw-term storage.

There is no attacker-controlled trigger and no network disclosure path: entries accumulate from ordinary authenticated activity, and an attacker's own requests deposit only their own digest. Exploitation requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper, at which point the digests support offline password attack against every active account. Whether the material persists depends on the data layer, since raw-term stores keep it verbatim while a SQL store raises Protocol.UndefinedError and drops the entry unless the user resource derives Jason.Encoder.

This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.
Published: 2026-09-17
Score: 1.8 Low
EPSS: n/a
KEV: No
Impact: Exposure of User Password Hashes
Action: Apply Patch
AI Analysis

Impact

Actor records, including their hashed_password attributes, are written verbatim into the audit store. The vulnerability allows anyone who can read the audit entries to retrieve password digests, which can be used for offline cracking of user accounts. This represents a log injection of sensitive data, classified as CWE‑532.

Affected Systems

The issue exists in the AshAuthentication library from team‑alembic. Versions from 4.12.0 through the most recent stable 4.15.0 release, and from 5.0.0‑rc.0 through the most recent stable 5.0.0‑rc.2 release, are affected. Users of AshAuthentication for authentication and logging are potentially impacted.

Risk and Exploitability

The CVSS score of 1.8 indicates a low severity rating. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of active exploitation. The attack requires independent read access to the audit store, such as database credentials, a privileged audit role, or a log shipper, with no remote trigger or network disclosure path. If an attacker gains such access, they can obtain password hashes for every active account and perform offline password attacks.

Generated by OpenCVE AI on September 17, 2026 at 22:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update ash_authentication to a fixed release (≥4.15.0 or ≥5.0.0‑rc.2).
  • Restrict audit store read access to only authorized roles and ensure credentials are properly protected.
  • Remove or mask stored actor information from audit logs, for example by disabling actor logging or filtering the hashed_password field.
  • Review existing audit entries for exposed password digests and advise users to reset passwords if necessary.

Generated by OpenCVE AI on September 17, 2026 at 22:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The audit_log add-on builds each entry's extra_data in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4, which takes :actor from the action callback context verbatim. Any audited action invoked with actor: set to a user record therefore deposits that record, including its hashed_password attribute, into the audit entry. The same module already collapses the audited identity to an opaque string via AshAuthentication.user_to_subject/1 and filters params against the strategy's configured allow-list, so the actor is the only stored value that reaches the audit store unfiltered. Marking the attribute sensitive?: true does not help, because that redacts inspect/1 output rather than JSON encoding or raw-term storage. There is no attacker-controlled trigger and no network disclosure path: entries accumulate from ordinary authenticated activity, and an attacker's own requests deposit only their own digest. Exploitation requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper, at which point the digests support offline password attack against every active account. Whether the material persists depends on the data layer, since raw-term stores keep it verbatim while a SQL store raises Protocol.UndefinedError and drops the entry unless the user resource derives Jason.Encoder. This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.
Title Actor record with password digest stored in AshAuthentication audit log entries
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-532
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 1.8, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-17T18:18:28.208Z

Reserved: 2026-08-31T00:59:08.960Z

Link: CVE-2026-82723

cve-icon Vulnrichment

Updated: 2026-09-17T18:18:23.782Z

cve-icon NVD

Status : Received

Published: 2026-09-17T14:17:32.863

Modified: 2026-09-17T19:17:04.150

Link: CVE-2026-82723

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T01:15:16Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File