CVE-2026-82759: Vulnerability in AshAuthentication Allows Reversible IP Address Pseudonymisation
Summary
CVE-2026-82759: Reversible IP address pseudonymisation in AshAuthentication audit log hash mode. Affects ash_authentication across 4 version ranges.
>= 4.12.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
>= 255cfc9c0e511b7e0de39f8b3d676ae994fae06c, < d8a9c4b6bde828fdc8346198d5e4f588b5937541
< c3a6d5fe0d4fd383ea81b0402db0a96638479478
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AshAuthentication is an open-source authentication library designed for Elixir applications. It provides various features for managing user authentication, including support for audit logging. The library's audit log add-on includes an IP privacy mode intended to pseudonymise client IP addresses. However, a flaw in its implementation exposes users to potential privacy risks.
Vulnerability Detail
The vulnerability arises from the use of a one-way hash function with a predictable salt in the AshAuthentication library. Specifically, the method AshAuthentication.AddOn.AuditLog.IpPrivacy.hash_ip/1 computes a SHA-256 hash of the client IP address concatenated with a salt. The salt is either read from application configuration or defaults to a hardcoded value, which is insecure. This allows attackers to precompute hash tables for the entire IPv4 address space, making it feasible to reverse-engineer the original IP addresses from the truncated hash values. The issue affects versions 4.12.0 to 4.15.0 and 5.0.0-rc.0 to 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.12.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that you configure a unique and secure salt in your application settings by setting the :audit_log_ip_salt or :secret keys in your configuration. This can help mitigate the risk until you can upgrade to a patched version.
Conclusion
CVE-2026-82759 presents a significant risk to applications using AshAuthentication due to its flawed IP address pseudonymisation method. It is crucial for developers to update to the latest versions to protect user privacy and data integrity.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-82759 is a vulnerability in the AshAuthentication library that allows for the reversible pseudonymisation of client IP addresses due to predictable salt usage in hashing.
The vulnerability affects AshAuthentication versions 4.12.0 to 4.15.0 and 5.0.0-rc.0 to 5.0.0-rc.14.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade immediately, configure a secure salt in your application settings to mitigate the risk until you can apply the patch.
The CVSS score of this vulnerability is 1.8, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
