CVE-2026-81632— Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Quick assessment
Affected
team-alembic ash_authentication_phoenix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： 漏洞描述：在 team-alembic 的 AshAuthenticationPhoenix 中，存在“包含敏感查询字符串的 HTTP 请求”漏洞。任何能够读取访问日志、代理日志或浏览器历史记录的人，都能恢复一次性的登录令牌，并以此令牌对应所有者的身份进行身份验证。 在密码登录成功后， 会将新签发的 作为查询参数构建 路径，并通过 GET 请求重定向浏览器至该路径。因此，该令牌会出现在请求行中，而 Web 服务器、反向代理、请求遥测系统以及浏览器自身的历史记录都会记录该令牌。这些日志和
Possible ATT&CK Techniques 3 AI
T1041 · Exfiltration Over C2 Channel T1567 · Exfiltration Over Web Service T1567.002 · Exfiltration to Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81632
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Source: CVE Program / CVE List V5
Vulnerability Description
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.
After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.
This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过GET请求中的查询字符串导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| team-alembic | ash_authentication_phoenix | 1.7.0 ~ 2.17.4 |
cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*
|
|
| team-alembic | ash_authentication_phoenix | 903f3a386e1aba2f7b070187ef6f31215a92bdfd ~ * |
cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*
|
|
| team-alembic | ash_authentication | 3.10.5 ~ 4.15.0 |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
| team-alembic | ash_authentication | eca8cadea0f1595ed2c10a0c177b1da9aa9e5269 ~ * |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-81632
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81632
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-81632 (5)
Vendor Advisories for CVE-2026-81632 (4)
Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total
| CVE-2026-82761 | 9.1 CRITICAL | Magic link single-use tokens replayable via TOCTOU race in AshAuthentication |
| CVE-2026-86533 | 9.1 CRITICAL | Revoked session accepted because the session jti is never checked in AshAuthentication and |
| CVE-2026-85500 | 9.1 CRITICAL | `require_confirmed_with` is not enforced on the action and fails open on an unreadable att |
| CVE-2026-88952 | 9.1 CRITICAL | OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic |
| CVE-2026-91039 | 9.1 CRITICAL | dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c |
| CVE-2026-82760 | 8.2 HIGH | Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in |
| CVE-2026-82685 | 7.6 HIGH | Confirmation token accepted on any record in AshAuthentication |
| CVE-2026-80218 | 7.6 HIGH | Sign-in token minted for one resource accepted by another in AshAuthentication |
| CVE-2026-78223 | 6.9 MEDIUM | Token revocation record built from unverified JWT claims in AshAuthentication |
| CVE-2026-86522 | 6.3 MEDIUM | Log injection via an unescaped password reset identity in AshAuthentication |
| CVE-2026-81637 | 2.3 LOW | Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication |
| CVE-2026-82723 | 1.8 LOW | Actor record with password digest stored in AshAuthentication audit log entries |
| CVE-2026-82759 | 1.8 LOW | Reversible IP address pseudonymisation in AshAuthentication audit log hash mode |
IV. Related Vulnerabilities
Same vendor: team-alembic
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-80218
Sign-in token minted for one resource accepted by another in
Same weakness: CWE-598
-
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter -
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Qu -
CVE-2026-61614
SolidInvoice's long-lived API tokens accepted as URL query p -
CVE-2026-82181
Le-yan｜Medical Practice Management System - Sensitive Data i -
CVE-2026-76179
Ebyte NA111-M Use of GET Request Method With Sensitive Query
V. Comments for CVE-2026-81632
No comments yet