The vulnerability arises because after a successful password sign-in, the AshAuthentication.Phoenix.Components.Password.SignInForm constructs a URL with the freshly issued user token as a query parameter and redirects the browser using an HTTP GET request. This causes the token to be transmitted in the request line, which is commonly logged by web servers, proxies, and stored in browser history. These logs and histories typically have longer retention and less protection than session storage, thus exposing the token to potential unauthorized access. The redirect destination is restricted to a local path, preventing open redirect exploitation but not mitigating the token exposure risk.

An attacker who can access server access logs, proxy logs, or a user's browser history can retrieve the single-use sign-in token and use it to authenticate as the token's owner. This compromises the security of the affected authentication system by allowing unauthorized access without needing the user's password. The vulnerability does not allow open redirects but exposes a live credential that should be transient and protected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid logging sensitive query strings or configure logs to exclude query parameters containing authentication tokens. Additionally, consider redesigning the authentication flow to avoid transmitting sensitive tokens in URL query parameters, for example by using POST requests or secure cookies.