CVE-2026-86522 Details
Description
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application. This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
A log injection vulnerability has been identified in the Team-Alembic AshAuthentication library, specifically in versions 4.2.0 prior to 4.15.0 and 5.0.0-rc.0 prior to 5.0.0-rc.14. This vulnerability allows an unauthenticated attacker to forge log entries by submitting a password reset identity that includes newlines or control characters. The issue arises because the 'RequestPasswordReset' action interpolates the identity directly into a warning log without proper escaping or truncation. While the resource name is sanitized, the identity is not, creating an opportunity for log manipulation. Additionally, in a PostgreSQL environment, an attacker can include a null byte to force the log entry, as the database rejects such bytes at the encoding layer, causing a struct error that can be exploited to reach the logging sink.
The vulnerability has been patched in AshAuthentication version 4.15.0 and 5.0.0-rc.14. Users can upgrade to these versions to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-86522.html | EEF | Advisory |
| https://github.com/team-alembic/ash_authentication/commit/3954f277929712755aef57a4a3a821688f121316 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/57c7cc3236bef0fa9da19cb315414f216488866d | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/fd19358bf0eee53ef13dcf17cc499bd4fb393981 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wg7g-r393-vr3g | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-86522 | EEF | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-117 | Improper Output Neutralization for Logs | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic AshAuthentication | >= 4.2.0, < 4.15.0 (semver) >= 5.0.0-rc.0, < 5.0.0-rc.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | EEF |