The vulnerability arises from improper output neutralization for logs (CWE-117) in the AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 function. The identity argument, which can be an email or username from a password reset request, is interpolated directly into Logger.warning/1 heredocs without escaping or truncation. While the resource logged alongside it is safely inspected, the identity is not, allowing an attacker to inject newline or control characters. This causes the log record to be split, enabling the attacker to forge log entries with chosen severity tags and content, potentially misleading log analysis or monitoring. The affected versions are >=4.2.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14 of ash_authentication. No known exploits are reported in the wild, and no vendor advisory or patch information is provided.

An unauthenticated attacker can manipulate application logs by injecting crafted input into the password reset identity field. This can result in forged log entries with attacker-controlled severity levels and content, potentially undermining the integrity and reliability of application logs. Such log forgery can hinder incident response and forensic investigations but does not directly lead to code execution or data compromise based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing input validation or sanitization on the password reset identity field to prevent injection of newlines or control characters before logging. Monitoring for suspicious log entries may help detect exploitation attempts.