Executive brief
AshAuthentication's audit logging system unintentionally stores full user account records—including hashed passwords—in the audit log when recording authenticated actions. While this requires an attacker to independently gain access to the audit store (via database credentials, backup files, or log access), once accessed, the stored password hashes can be used for offline cracking attacks against all active user accounts.
Technical details
An insertion of sensitive information vulnerability exists in AshAuthentication's audit_log add-on module. The build_extra_data/4 function in AshAuthentication.AddOn.AuditLog.Auditor deposits the actor record verbatim from the action context into the audit entry without filtering, causing hashed password fields to be stored. The module already redacts other values via user_to_subject/1 and parameter filtering, making the actor the sole unfiltered value reaching the store. Marking attributes with sensitive?: true does not prevent JSON encoding or raw-term storage. Exploitation requires independent read access to the audit data layer (database access, backups, log shipping systems); persistence depends on the underlying storage type (raw-term stores retain it, while SQL stores may raise errors unless Jason.Encoder is used). The vulnerability affects AshAuthentication versions 4.12.0–4.14.x and 5.0.0-rc.0–5.0.0-rc.1.
Affected products
- team-alembic AshAuthentication 4.12.0–4.14.x, 5.0.0-rc.0–5.0.0-rc.1
Timeline
- 2026-09-17: disclosed