CVE-2026-82759

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13

Description AshAuthentication contains an issue where readers of the audit store can recover client IP addresses that the audit log add-on's :hash privacy mode is intended to pseudonymise. The function hash ip/1 computes an unkeyed :crypto.hash(:sha256, salt <> ip) and truncates the result to 16 hexadecimal characters. The salt is retrieved from the :audit log ip salt or :secret application config keys; however, it defaults to a constant string "default-salt-change-in-production" if neither is set, without providing a warning. Because the IPv4 address space is limited to 2^32 values and SHA-256 is computationally efficient, the hash table can be precomputed, allowing stored values to be mapped back to their original source addresses. This risk persists even with a configured salt if the salt is leaked, as the hash remains cheap to enumerate.

Recommendations Update ash authentication to version 4.15.0 or later. Update ash authentication to version 5.0.0-rc.14 or later. As a temporary mitigation, avoid setting the ip privacy mode to :hash in the audit log add-on configuration, using :none, :truncate, or :exclude instead.