EEF-CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

🗓️ 23 Oct 2026 09:56:58Reported by GoogleType

osv_eef🔗 osv.dev👁 3 Views

Unauthenticated remote attacker can expose secret key base in logs via plug_crypto.

Reporter	Title	Published	Views	Family All 5
Circl	CVE-2026-105963	23 Oct 202610:06	–	circl
CVE	CVE-2026-105963	23 Oct 202609:56	–	cve
Cvelist	CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments	23 Oct 202609:56	–	cvelist
EUVD	EUVD-2026-108666	23 Oct 202609:56	–	euvd
NVD	CVE-2026-105963	23 Oct 202610:16	–	nvd

Source	Link
github	www.github.com/elixir-plug/plug/security/advisories/GHSA-ffw9-w85g-f2vh
cna	www.cna.erlef.org/cves/CVE-2026-105963.html
github	www.github.com/elixir-plug/plug/commit/56000c33d8a0a2fbac491f8be06b9c5112bc2276
github	www.github.com/elixir-plug/plug/commit/aeaa90e76b73ea90c3ecca9aae16fce71bd2a8d4
github	www.github.com/elixir-plug/plug_crypto/commit/2d078b7b8264c565f0ff71235c515f4f46882dcf
github	www.github.com/elixir-plug/plug_crypto/commit/981887493dada0fce7003c61861c00dfbb0fc8c5
hex	www.hex.pm/packages/plug
hex	www.hex.pm/packages/plug_crypto

23 Oct 2026 10:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.1

plug_crypto secret key base FunctionClauseError application logs Plug.Crypto.verify/4 Plug.Crypto.secure_compare/2