CVE-2026-81632 Details
Description
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential. This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
A vulnerability in Team Alembic's AshAuthentication and AshAuthenticationPhoenix libraries allows for the unintentional exposure of single-use sign-in tokens. This issue arises after a successful password authentication, where the token is included as a query parameter in a redirect. As a result, the token is recorded in various locations such as web server logs, proxy logs, and browser history, all of which can persist beyond the duration of the request. This vulnerability is present in AshAuthentication versions 3.10.5 prior to 4.15.0 and 5.0.0-rc.0 prior to 5.0.0-rc.14, as well as in AshAuthenticationPhoenix versions 1.7.0 prior to 2.17.4 and 3.0.0-rc.0 prior to 3.0.0-rc.11.
Users can upgrade to AshAuthentication version 4.15.0 or 5.0.0-rc.14, and to AshAuthenticationPhoenix version 2.17.4 or 3.0.0-rc.11. For applications on the 4.x line, the 'sign_in_token_via_post?' option can be enabled to replace the GET route with a POST route, allowing the token to be sent in a request body instead of a query string. However, this option should only be set after upgrading to a version of AshAuthenticationPhoenix that supports it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic AshAuthenticationPhoenix | >= 1.7.0, < 2.17.4 (semver) >= 3.0.0-rc.0, < 3.0.0-rc.11 (semver) |
CPE
Remediation
| |
| team-alembic AshAuthentication | >= 3.10.5, < 4.15.0 (semver) >= 5.0.0-rc.0, < 5.0.0-rc.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | EEF |