Use of a one‑way hash with a predictable salt in AshAuthentication's audit log IP pseudonymisation mode allows anyone who can read the audit store to reverse‑engineer client IP addresses. The function truncates the SHA‑256 hash to 16 hexadecimal characters, but because the salt is constant or predictable, the mapping from hash to IP is trivially pre‑computable. The result is a confidentiality exposure of IP addresses that should have been protected.

The issue affects the team‑alembic AshAuthentication library. Versions 4.12.0 up to but not including 4.15.0, and 5.0.0‑rc.0 up to but not including 5.0.0‑rc.14 are vulnerable.

The CVSS score of 1.8 indicates low overall severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers must be able to read the audit store, which typically requires local filesystem or database access. Once a hash is read, an attacker can pre‑compute a simple lookup table of all 2^32 IPv4 addresses hashed with the known salt, or use the default salt if the application is in its default configuration. Because SHA‑256 computation is fast, such a lookup can be completed in seconds on commodity hardware, making the exploit practical for anyone who gains local or remote read access to the audit logs.