CVE-2026-82727: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_phoenix

The vulnerability arises in ash_phoenix's AshPhoenix.Form.Auto module when building a union sub-form. If the submitted _union_type parameter does not match any configured type, the error message generated includes a full inspection of the submitted parameters and internal union constraints. This inspection embeds sensitive data such as passwords in exception messages, which are logged and displayed without redaction because they are constructed outside Phoenix's parameter filtering mechanism. An attacker can exploit this by submitting crafted parameters containing secrets, causing them to be exposed in logs and error pages. The issue affects ash_phoenix versions from 1.2.17 before 2.3.25. The fix involves limiting the error message to only report the invalid _union_type and valid type names, excluding the full parameter and constraint dumps.

Sensitive information submitted in form parameters, including secrets like passwords, can be exposed in error messages, logs, crash reports, and developer error pages. This leakage can lead to unintended disclosure of confidential data, potentially aiding attackers in reconnaissance or further attacks. The vulnerability does not directly allow code execution or privilege escalation but poses a confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing detailed error messages containing raw submitted parameters in production environments. Limit access to logs and error reports to trusted personnel only. Monitor vendor communications for updates on patches or official fixes.