CVE-2026-82759— Reversible IP address pseudonymisation in AshAuthentication audit log hash mode
Quick assessment
Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： 漏洞描述翻译： 在 team-alembic 的 AshAuthentication 库中，存在一个使用可预测盐值的一次性哈希的漏洞。该漏洞使得能够读取审计存储（audit store）的用户，可以还原出本应由审计日志插件的 隐私模式进行伪名化的客户端 IP 地址。 技术细节分析： 1. 哈希计算方式： 函数通过执行 计算一个未加密钥的哈希值，并将结果截断为 16 个十六进制字符。 2. 盐值来源与默认值风险： 盐值（salt）从应用配置键 或 中读取。如果两者均未设置，系统会回退到库
Possible ATT&CK Techniques 3 AI
T1005 · Data from Local System T1114 · Email Collection T1539 · Steal Web Session Cookie
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82759
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reversible IP address pseudonymisation in AshAuthentication audit log hash mode
Source: CVE Program / CVE List V5
Vulnerability Description
Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise.
AshAuthentication.AddOn.AuditLog.IpPrivacy.hash_ip/1 computes a single unkeyed :crypto.hash(:sha256, salt <> ip) and truncates the result to 16 hexadecimal characters. The salt is read from the :audit_log_ip_salt or :secret application config keys, and falls back to the constant "default-salt-change-in-production" published in the library source when neither is set, with nothing warning that the default is in use. The IPv4 space is only 2^32 values and SHA-256 is fast, so the whole hash table is precomputable and every stored value maps back to its source address. Truncating to 16 characters does not help, and even a configured salt leaves the hash cheap enough to enumerate once it leaks.
This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用可预测Salt的单向哈希算法
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| team-alembic | ash_authentication | 4.12.0 ~ 4.15.0 |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
| team-alembic | ash_authentication | 255cfc9c0e511b7e0de39f8b3d676ae994fae06c ~ * |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82759
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82759
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82759 (1)
Vendor Advisories for CVE-2026-82759 (1)
Other References for CVE-2026-82759 (2)
Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total
| CVE-2026-82761 | 9.1 CRITICAL | Magic link single-use tokens replayable via TOCTOU race in AshAuthentication |
| CVE-2026-86533 | 9.1 CRITICAL | Revoked session accepted because the session jti is never checked in AshAuthentication and |
| CVE-2026-85500 | 9.1 CRITICAL | `require_confirmed_with` is not enforced on the action and fails open on an unreadable att |
| CVE-2026-88952 | 9.1 CRITICAL | OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic |
| CVE-2026-91039 | 9.1 CRITICAL | dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c |
| CVE-2026-82760 | 8.2 HIGH | Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in |
| CVE-2026-82685 | 7.6 HIGH | Confirmation token accepted on any record in AshAuthentication |
| CVE-2026-80218 | 7.6 HIGH | Sign-in token minted for one resource accepted by another in AshAuthentication |
| CVE-2026-81632 | 7.2 HIGH | Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix |
| CVE-2026-78223 | 6.9 MEDIUM | Token revocation record built from unverified JWT claims in AshAuthentication |
| CVE-2026-86522 | 6.3 MEDIUM | Log injection via an unescaped password reset identity in AshAuthentication |
| CVE-2026-81637 | 2.3 LOW | Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication |
| CVE-2026-82723 | 1.8 LOW | Actor record with password digest stored in AshAuthentication audit log entries |
IV. Related Vulnerabilities
Same product: ash_authentication
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-80218
Sign-in token minted for one resource accepted by another in
Same vendor: team-alembic
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-81632
Single-use sign-in token placed in a redirect query string i
Same weakness: CWE-760
V. Comments for CVE-2026-82759
No comments yet