AIKIDO-2026-19848
ash_authentication is vulnerable to Log Injection
40
Medium Risk
This Affects:
ash_authenticationTL;DR
In ash_authentication, log injection through an unescaped password reset identity in AshAuthentication. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_authentication is vulnerable to Log Injection in versions 4.2.0 - 4.14.2.
How to fix this
Upgrade the ash_authentication library to the patch version.
Links
Fix Commits
github.com/team-alembic/ash_authentication/commit/3954f277929712755aef57a4a3a821688f121316github.com/team-alembic/ash_authentication/commit/57c7cc3236bef0fa9da19cb315414f216488866dgithub.com/team-alembic/ash_authentication/commit/fd19358bf0eee53ef13dcf17cc499bd4fb393981
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.