Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105963— Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

Quick assessment

Affected
elixir-plug plug
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述：外部生成的错误消息中包含敏感信息 Elixir 的 库（属于 项目）中存在一个漏洞：未认证的远程攻击者可通过传入类型错误的参数，在应用日志中暴露密钥基础值（secret key base）。 中的每个公共函数都会在函数头部守卫（function-head guard）中对参数类型进行验证。一旦守卫失败，Erlang 虚拟机将抛出 ，并在顶层栈帧中包含实际传入的参数值。因此，密钥基础值、派生密钥或用于 API 密钥比对的值可能会出现在该栈帧中。然而，该库的 块以及 函数仅能捕获函数体内部抛出的异常，无法处理

CVSS 5.1 · Medium EPSS 0.71% · P53

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Affected Version Matrix 4

VendorProduct Version RangeStatus
elixir-plug plug 1.6.3< 1.7.0 affected
56000c33d8a0a2fbac491f8be06b9c5112bc2276< * affected
elixir-plug plug_crypto 1.0.0< 2.2.1 affected
2d078b7b8264c565f0ff71235c515f4f46882dcf< 981887493dada0fce7003c61861c00dfbb0fc8c5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105963

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Source: CVE Program / CVE List V5
Vulnerability Description
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward. Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-plug plug 1.6.3 ~ 1.7.0 cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*
elixir-plug plug 56000c33d8a0a2fbac491f8be06b9c5112bc2276 ~ * cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*
elixir-plug plug_crypto 1.0.0 ~ 2.2.1 cpe:2.3:a:elixir-plug:plug_crypto:*:*:*:*:*:*:*:*
elixir-plug plug_crypto 2d078b7b8264c565f0ff71235c515f4f46882dcf ~ 981887493dada0fce7003c61861c00dfbb0fc8c5 cpe:2.3:a:elixir-plug:plug_crypto:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-105963

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105963

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-105963 (3)

Vendor Advisories for CVE-2026-105963 (3)

IV. Related Vulnerabilities

Same product: plug
Same vendor: elixir-plug
Same weakness: CWE-532

V. Comments for CVE-2026-105963

No comments yet

Leave a comment