The vulnerability arises from the use of an unkeyed SHA-256 hash with a predictable salt to pseudonymize IP addresses in the ash_authentication audit log add-on. The salt is either a constant default string or a configurable value, but the default is used without warning. The hash output is truncated to 16 hex characters, which does not prevent precomputation attacks due to the limited IPv4 space and fast hashing. This allows an attacker with access to the audit store to recover client IP addresses that the privacy mode intended to conceal. The affected versions are >=4.12.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14.

The impact is limited to the ability of an attacker who can read the audit store to recover client IP addresses that were meant to be pseudonymized. This compromises privacy but does not directly lead to system compromise or code execution. The CVSS score is low (1.8) reflecting the limited attack vector (local access) and low impact.

No explicit patch or remediation is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using the default salt and configure a strong, secret salt value to increase the cost of precomputation attacks. Consider disabling the :hash privacy mode or using a more secure pseudonymization method until an official fix is available.