CVE-2026-82759 Details
Description
Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.hash_ip/1 computes a single unkeyed :crypto.hash(:sha256, salt <> ip) and truncates the result to 16 hexadecimal characters. The salt is read from the :audit_log_ip_salt or :secret application config keys, and falls back to the constant "default-salt-change-in-production" published in the library source when neither is set, with nothing warning that the default is in use. The IPv4 space is only 2^32 values and SHA-256 is fast, so the whole hash table is precomputable and every stored value maps back to its source address. Truncating to 16 characters does not help, and even a configured salt leaves the hash cheap enough to enumerate once it leaks. This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
A vulnerability in the Team-Alembic AshAuthentication library's audit log feature allows for the recovery of client IP addresses from logs that are supposed to anonymize this information. This issue arises because the hashing method used for privacy is predictable and can be reversed. The vulnerability affects versions 4.12.0 prior to 4.15.0, and 5.0.0-rc.0 prior to 5.0.0-rc.14.
Users can upgrade to AshAuthentication versions 4.15.0 or 5.0.0-rc.14, where this vulnerability is fixed. After upgrading, it's recommended to configure a secret salt under the application's name to ensure proper hashing of IP addresses. For those who cannot upgrade immediately, switching the IP privacy mode to 'truncate' or 'exclude' can be a temporary solution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-82759.html | EEF | Advisory |
| https://github.com/team-alembic/ash_authentication/commit/255cfc9c0e511b7e0de39f8b3d676ae994fae06c | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/c3a6d5fe0d4fd383ea81b0402db0a96638479478 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/d8a9c4b6bde828fdc8346198d5e4f588b5937541 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-cgqj-pcpq-xhfm | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-82759 | EEF | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-760 | Use of a One-Way Hash with a Predictable Salt | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic AshAuthentication | >= 4.12.0, < 4.15.0 (semver) >= 5.0.0-rc.0, < 5.0.0-rc.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | EEF |