---
id: CVE-2026-81632
title: >-
  Use of HTTP Request With Sensitive Query String vulnerability in team-alembic
  AshAuthenticationPhoenix allows someone able to read access logs, proxy logs
  or browser history to recover a single-use sign-in token and authenticate as
  its o…
summary: >-
  Use of HTTP Request With Sensitive Query String vulnerability in team-alembic
  AshAuthenticationPhoenix allows someone able to read access logs, proxy logs
  or browser history to recover a single-use sign-in token and authenticate as
  its o…
severity: high
cvss: 7.2
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-598
vendor: team-alembic
product: ash_authentication_phoenix
affected:
  - ash_authentication_phoenix >= 1.7.0 < 2.17.4
  - ash_authentication_phoenix >= 3.0.0-rc.0 < 3.0.0-rc.11
  - >-
    team-alembic/ash_authentication_phoenix >=
    903f3a386e1aba2f7b070187ef6f31215a92bdfd < *
  - ash_authentication >= 3.10.5 < 4.15.0
  - ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.14
  - >-
    team-alembic/ash_authentication >= eca8cadea0f1595ed2c10a0c177b1da9aa9e5269
    < *
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:16:18.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81632'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-81632.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/8d8ddd25c69b669a92a701af74bff42e1aada998
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/bbf345c1bb7aa28bce5dd856ac0ed2427f103859
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j726-59hm-r46r
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication_phoenix/commit/903f3a386e1aba2f7b070187ef6f31215a92bdfd
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication_phoenix/commit/920257d0460b9c7cbb42a83d0888c10f4eeeb88a
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication_phoenix/commit/ff5ad8737748afed9cdfde3ec3a05b8a4702a742
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-8jh5-339h-mqx9
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-81632'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
tags:
  - nvd
  - cve.org
epss: 0.00211
epssPercentile: 0.10262
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T18:29:05.558007Z'
cvssSource: cna
ingestedAt: '2026-09-17T13:18:16.986Z'
---

## Overview

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.

After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.

This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.