# CVE-2026-81632: team-alembic AshAuthenticationPhoenix sensitive query string in sign-in token

Source: https://junglewise.ai/threats/cve-2026-81632-team-alembic-ashauthenticationphoenix-sensitive-query-string-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81632 · Severity: info · Published 2026-09-17

AshAuthenticationPhoenix is an authentication library for Elixir/Phoenix web applications. After a user signs in with their password, the application redirects the browser to a special link containing a single-use authentication token in the URL. This token gets recorded in web server logs, proxy logs, browser history, and other places that are typically less secured than session cookies, allowing anyone with access to these logs to impersonate the user.

Vendors: [Team-Alembic](https://junglewise.ai/threats/vendors/team-alembic).

## Quick answers

**Is CVE-2026-81632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81632 being exploited in the wild.

**How severe is CVE-2026-81632?** Informational severity, published 17 September 2026.

**Which products and versions are affected?** Team-Alembic AshAuthenticationPhoenix 1.7.0 before 2.17.4 and 3.0.0-rc.0 before 3.0.0-rc.11.

**Is there a fix for CVE-2026-81632?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81632 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81632?** Check whether you run Team-Alembic AshAuthenticationPhoenix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is improper credential handling in HTTP requests (CWE-598). The AshAuthentication.Phoenix.Components.Password.SignInForm component constructs a sign_in_with_token redirect path using a freshly-issued user authentication token as a query parameter, transmitting it via GET request. This causes the sensitive token to appear in the HTTP request line, where it is logged by web servers, reverse proxies, request telemetry systems, and browser history—all of which typically persist longer than a session and have weaker access controls. While the redirect destination is restricted to local paths (preventing open redirect), the live credential remains exposed in logged artifacts. The vulnerability affects ash_authentication_phoenix versions 1.7.0 before 2.17.4 and 3.0.0-rc.0 before 3.0.0-rc.11, as well as ash_authentication versions 3.10.5 before 4.15.0 and 5.0.0-rc.0 before 5.0.0-rc.14. Patches are available in fixed versions.

## Affected products

- team-alembic AshAuthenticationPhoenix 1.7.0 before 2.17.4 and 3.0.0-rc.0 before 3.0.0-rc.11
- team-alembic AshAuthentication 3.10.5 before 4.15.0 and 5.0.0-rc.0 before 5.0.0-rc.14

## Timeline

- 2026-09-17: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)