CVE-2026-15603

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.0

Description An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the remote-user token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records.

Recommendations Upgrade to version 1.12.0.