CVE-2026-86522

Log injection via an unescaped password reset identity in AshAuthentication

State: Published
Severity: 6.3 Medium
Published: Sep 17, 2026
Updated: Sep 17, 2026
Reserved: Sep 7, 2026

Description

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters.

AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application.

This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N	EEF

Weaknesses

CWE-117 Improper Output Neutralization for Logs

Affected Products

Product	Versions
ash_authenticationteam-alembic	4.2.0 to before 4.15.0Affected 5.0.0-rc.0 to before 5.0.0-rc.14Affected
ash_authenticationteam-alembic	3954f277929712755aef57a4a3a821688f121316 and laterAffectedfrom fd19358bf0eee53ef13dcf17cc499bd4fb393981Not affectedfrom 57c7cc3236bef0fa9da19cb315414f216488866dNot affected

References

https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wg7g-r393-vr3gvendor-advisoryrelated
EEF CNA record for CVE-2026-86522related
OSV record EEF-CVE-2026-86522related
Introducing commit 3954f27 in team-alembic/ash_authenticationrelated
Fix commit fd19358 in team-alembic/ash_authenticationpatch
Fix commit 57c7cc3 in team-alembic/ash_authenticationpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.