CVE-2026-105963: plug 1.6.3 to before 1.7.0; +1 more affected products

Affected technology

plug · 1.6.3 to before 1.7.0
elixir-plug

plug · 56000c33d8a0a2fbac491f8be06b9c5112bc2276 to before *
elixir-plug

plug_crypto · 1.0.0 to before 2.2.1
elixir-plug

plug_crypto · 2d078b7b8264c565f0ff71235c515f4f46882dcf to before 981887493dada0fce7003c61861c00dfbb0fc8c5
elixir-plug

Component: 'Elixir.Plug.Crypto', 'Elixir.Plug.Crypto.MessageVerifier', 'Elixir.Plug.Crypto.MessageEncryptor'
Function: 'Elixir.Plug.Crypto':secure_compare/2, 'Elixir.Plug.Crypto':masked_compare/3, 'Elixir.Plug.Crypto':verify/4, 'Elixir.Plug.Crypto':decrypt/4, 'Elixir.Plug.Crypto':mask/2, 'Elixir.Plug.Crypto':sign/4, 'Elixir.Plug.Crypto':encrypt/4, 'Elixir.Plug.Crypto.MessageVerifier':sign/3, 'Elixir.Plug.Crypto.MessageVerifier':verify/2, 'Elixir.Plug.Crypto.MessageEncryptor':encrypt/4, 'Elixir.Plug.Crypto.MessageEncryptor':decrypt/4, in, body
File: lib/plug/crypto.ex, lib/plug/crypto/message_verifier.ex, lib/plug/crypto/message_encryptor.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can expose the secret key base through application logs via a wrong-typed argument. Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality impact as low; integrity and availability impact as none.