CVE-2026-86522
mediumpriority · track · 0EPSS 0.007 · 54 %ileUSEPSS · scored 2026-10-27
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application. This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–6.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- EEF-CVE-2026-86522Log injection via an unescaped password reset identity in AshAuthentication2026-09-17vendor · osvUS
## Summary Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. `AshAuthentication.Strategy.Password.RequestPasswordReset.run/3` interpolates the `identity` argument, the email or username taken straight from the reset request, into its `Logger.warning/1` heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through `inspect/1`, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application. This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
also known as (1)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6) nvd
External citations — patches, advisories, analysis.
- https://cna.erlef.org/cves/CVE-2026-86522.html
- https://github.com/team-alembic/ash_authentication/commit/3954f277929712755aef57a4a3a821688f121316
- https://github.com/team-alembic/ash_authentication/commit/57c7cc3236bef0fa9da19cb315414f216488866d
- https://github.com/team-alembic/ash_authentication/commit/fd19358bf0eee53ef13dcf17cc499bd4fb393981
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wg7g-r393-vr3g
- https://osv.dev/vulnerability/EEF-CVE-2026-86522
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan