CVE-2026-86522: Log Injection Vulnerability in AshAuthentication Package
Summary
CVE-2026-86522: Log injection via an unescaped password reset identity in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 4.2.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
< 57c7cc3236bef0fa9da19cb315414f216488866d
>= 3954f277929712755aef57a4a3a821688f121316, < fd19358bf0eee53ef13dcf17cc499bd4fb393981
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is an authentication library for Elixir applications, designed to provide a robust and flexible authentication mechanism. It allows developers to implement user authentication features such as password resets, user sessions, and identity management. However, a recent vulnerability has been identified that can lead to log injection attacks, compromising the integrity of application logs.
Vulnerability Detail
The vulnerability arises from improper output neutralization for logs in the AshAuthentication package. Specifically, the method 'AshAuthentication.Strategy.Password.RequestPasswordReset.run/3' directly interpolates user-provided input (the password reset identity) into log messages without proper escaping or truncation. This allows an unauthenticated attacker to inject newlines or control characters into the logs, effectively allowing them to forge log entries. The ramifications include the potential for misleading log entries that could be used to manipulate or mislead developers and system administrators, as the attacker can control the content and severity of the logs.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any user input used in logging is sanitized before being logged. You can implement a function to escape or truncate the input before logging it. For example:
def sanitize_input(input) do
String.replace(input, "\n", "")
|> String.replace("\r", "")
end
Logger.warning("Password reset request from: #{sanitize_input(identity)}")
Conclusion
CVE-2026-86522 represents a significant risk for applications using the AshAuthentication package due to its log injection vulnerability. It is crucial for developers to update to the latest patched versions and implement input sanitization to mitigate potential risks.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-86522 is a vulnerability in the AshAuthentication package that allows log injection via unescaped user input during password reset requests.
Any application using AshAuthentication versions from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14 is affected.
An attacker can forge log entries, potentially misleading developers and system administrators about the application's behavior and security state.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
The CVSS score for CVE-2026-86522 is 6.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
