## Summary

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex\_core (hex\_api modules), hexpm hex (mix\_hex\_api modules), erlang rebar3 (r3\_hex\_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex\_api.erl, src/mix\_hex\_api.erl, apps/rebar/src/vendored/r3\_hex\_api.erl and program routines hex\_core:request/4, mix\_hex\_api:request/4, r3\_hex\_api:request/4.

This issue affects hex\_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

## Summary

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store.

The `audit_log` add-on builds each entry's `extra_data` in `AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4`, which takes `:actor` from the action callback context verbatim. Any audited action invoked with `actor:` set to a user record therefore deposits that record, including its `hashed_password` attribute, into the audit entry. The same module already collapses the audited identity to an opaque string via `AshAuthentication.user_to_subject/1` and filters `params` against the strategy's configured allow-list, so the actor is the only stored value that reaches the audit store unfiltered. Marking the attribute `sensitive?: true` does not help, because that redacts `inspect/1` output rather than JSON encoding or raw-term storage.

There is no attacker-controlled trigger and no network disclosure path: entries accumulate from ordinary authenticated activity, and an attacker's own requests deposit only their own digest. Exploitation requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper, at which point the digests support offline password attack against every active account. Whether the material persists depends on the data layer, since raw-term stores keep it verbatim while a SQL store raises `Protocol.UndefinedError` and drops the entry unless the user resource derives `Jason.Encoder`.

This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.

## Summary

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's `:hash` privacy mode is meant to pseudonymise.

`AshAuthentication.AddOn.AuditLog.IpPrivacy.hash_ip/1` computes a single unkeyed `:crypto.hash(:sha256, salt <> ip)` and truncates the result to 16 hexadecimal characters. The salt is read from the `:audit_log_ip_salt` or `:secret` application config keys, and falls back to the constant `"default-salt-change-in-production"` published in the library source when neither is set, with nothing warning that the default is in use. The IPv4 space is only 2^32 values and SHA-256 is fast, so the whole hash table is precomputable and every stored value maps back to its source address. Truncating to 16 characters does not help, and even a configured salt leaves the hash cheap enough to enumerate once it leaks.

This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

## Configurations

Only applications that enable the `audit_log` add-on and set its `ip_privacy` mode to `:hash` store the affected value. Other modes (`:none`, `:truncate`, `:exclude`) do not reach `hash_ip/1`.

The complete break additionally requires the default salt, that is neither `:audit_log_ip_salt` nor `:secret` configured under the `:ash_authentication` application. This is the out-of-the-box state: no warning or error is raised when the hardcoded salt is in use.

CVE ID↕	Published↕	CVSS↓
EEF-CVE-2026-21619	Feb 27, 2026	Low 2
EEF-CVE-2026-82723	Sep 17, 2026	Low 1.8
EEF-CVE-2026-82759	Sep 17, 2026	Low 1.8

Know every vulnerability
before it knows you.

hex CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

hex CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.