CVE-2026-82723 team-alembic CVE debrief

Who should care

Defenders responsible for AshAuthentication configurations, authentication and authorization settings, and audit store access controls should assess exposure and prioritize remediation.

Why it matters

CVE-2026-82723 is a low-severity vulnerability in AshAuthentication that allows disclosure of user password digests. Defenders should prioritize verifying exposure, reviewing authentication settings, and ensuring proper access controls.

• Support offline password attacks against active accounts with access to the audit store
• Require verification of AshAuthentication audit store configurations for potential exposure
• Necessitate review of authentication and authorization settings to ensure proper access controls

Technical summary

The audit_log add-on in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4 takes :actor from the action callback context verbatim and deposits it, including its hashed_password attribute, into the audit entry. This allows disclosure of user password digests to readers of the audit store. The issue requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper. The vulnerability affects ash_authentication versions from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2. Defenders should prioritize verifying exposure in AshAuthentication audit store configurations, reviewing authentication and authorization settings, and ensuring

Defensive priority

Defenders should prioritize verifying exposure in AshAuthentication audit store configurations, reviewing authentication and authorization settings, and ensuring proper access controls are in place.

Recommended defensive actions

• Verify AshAuthentication audit store configurations for potential exposure
• Review authentication and authorization settings to ensure proper access controls
• Ensure that audit store access is restricted to authorized personnel
• Consider upgrading to ash_authentication version 4.15.0 or later, or 5.0.0-rc.2 or later
• Perform vulnerability scanning to identify potential exposure
• Implement additional monitoring to detect potential exploitation attempts
• Review incident response plans to ensure preparedness for potential breaches

Evidence notes

The vulnerability is caused by the audit_log add-on in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4, which takes :actor from the action callback context verbatim and deposits it, including its hashed_password attribute, into the audit entry. The issue requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.