CVE-2026-82723

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The audit_log add-on builds each entry's extra_data in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4, which takes :actor from the action callback context verbatim. Any audited action invoked with actor: set to a user record therefore deposits that record, including its hashed_password attribute, into the audit entry. The same module already collapses the audited identity to an opaque string via AshAuthentication.user_to_subject/1 and filters params against the strategy's configured allow-list, so the actor is the only stored value that reaches the audit store unfiltered. Marking the attribute sensitive?: true does not help, because that redacts inspect/1 output rather than JSON encoding or raw-term storage. There is no attacker-controlled trigger and no network disclosure path: entries accumulate from ordinary authenticated activity, and an attacker's own requests deposit only their own digest. Exploitation requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper, at which point the digests support offline password attack against every active account. Whether the material persists depends on the data layer, since raw-term stores keep it verbatim while a SQL store raises Protocol.UndefinedError and drops the entry unless the user resource derives Jason.Encoder. This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.

• CWE-532

• https://cna.erlef.org/cves/CVE-2026-82723.html
• https://github.com/team-alembic/ash_authentication/commit/17ea0dff3bad56a7e915e050c43ab7160b37901f
• https://github.com/team-alembic/ash_authentication/commit/255cfc9c0e511b7e0de39f8b3d676ae994fae06c
• https://github.com/team-alembic/ash_authentication/commit/f6b49cc98b9ff7c16a1aeb12e35633a8d93a211f
• https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-59wx-q3r8-ghv4
• https://osv.dev/vulnerability/EEF-CVE-2026-82723

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82712Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior ar…8.8
• CVE-2026-82716The Botslab G980H dash camera firmware includes sensitive co…4.6
• CVE-2026-82717In NLnet Labs Unbound up to and including 1.26.0, a vulnerab…9.8
• CVE-2026-8272A security flaw has been discovered in D-Link DNS-320 2.06B0…7.2
• CVE-2026-82720NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a u…5.9
• CVE-2026-82722Allocation of Resources Without Limits or Throttling vulnera…8.3
• CVE-2026-82724Incorrect Authorization vulnerability in ash-project ash_pho…7.6
• CVE-2026-82725Authorization Bypass Through User-Controlled Key vulnerabili…2.3
• CVE-2026-82726Permissive Regular Expression vulnerability in ash-project a…6.3
• CVE-2026-82727Generation of Error Message Containing Sensitive Information…2.3
• CVE-2026-82728Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-82729Inefficient Algorithmic Complexity vulnerability in elixir-m…6.3