CVE-2026-82759

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...

EEF-CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

Summary Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1...

CVE-2026-82759

AshAuthentication (team-alembic), an Elixir authentication library, contains a vulnerability in its audit log IP privacy mode. The function IpPrivacy.hash_ip/1 computes an unkeyed SHA-256 hash using a salt that falls back to the publicly known constant "default-salt-change-in-production". Because...