The issue is an improper output neutralization for logs (CWE-117). AshAuthentication interpolates the password reset identity directly into a log warning, without escaping or truncation. A malicious user can include newline or control characters, causing the log to split into multiple entries and allowing the attacker to forge log messages with arbitrary severity tags and content. This can disguise malicious actions, mislead administrators, or clutter log entries, undermining the reliability of audit trails.

The vulnerability impacts the AshAuthentication component from team‑alembic. Versions from 4.2.0 up to but not including 4.15.0, and from 5.0.0‑rc.0 up to but not including 5.0.0‑rc.14, are affected.

The CVSS base score of 6.3 indicates a medium impact. Because the flaw is exploitable through an unauthenticated password reset request, an attacker can achieve log tampering at will. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalogue, so there is no data on recent exploit activity. The lack of procedural restrictions means the attack path is straightforward: submit a crafted identity during a reset request and observe forged logs. Vendors have released patches that prevent the failure to neutralize the identity; upgrading to a version >=4.15.0 or >=5.0.0‑rc.14 mitigates the risk.