Medium

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

Type: advisorySource: Official CVE List1 source record

Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward. Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.

Announced 23 Oct 2026Group revision 1

Original source ↗

CVE-2026-105963

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-105963

plug

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

plug

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

plug_crypto

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

plug_crypto

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-plug/plug",
    "vendor": "elixir-plug",
    "modules": [
      "'Elixir.Plug.Crypto'"
    ],
    "product": "plug",
    "versions": [
      {
        "status": "affected",
        "version": "1.6.3",
        "lessThan": "1.7.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:hex/plug",
    "packageName": "plug",
    "programFiles": [
      "lib/plug/crypto.ex"
    ],
    "collectionURL": "https://repo.hex.pm",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Plug.Crypto':secure_compare/2"
      },
      {
        "name": "'Elixir.Plug.Crypto':masked_compare/3"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-plug/plug",
    "vendor": "elixir-plug",
    "modules": [
      "'Elixir.Plug.Crypto'"
    ],
    "product": "plug",
    "versions": [
      {
        "status": "affected",
        "version": "56000c33d8a0a2fbac491f8be06b9c5112bc2276",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/elixir-plug/plug",
    "packageName": "elixir-plug/plug",
    "programFiles": [
      "lib/plug/crypto.ex"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Plug.Crypto':secure_compare/2"
      },
      {
        "name": "'Elixir.Plug.Crypto':masked_compare/3"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:elixir-plug:plug_crypto:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-plug/plug_crypto",
    "vendor": "elixir-plug",
    "modules": [
      "'Elixir.Plug.Crypto'",
      "'Elixir.Plug.Crypto.MessageVerifier'",
      "'Elixir.Plug.Crypto.MessageEncryptor'"
    ],
    "product": "plug_crypto",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "2.2.1",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:hex/plug_crypto",
    "packageName": "plug_crypto",
    "programFiles": [
      "lib/plug/crypto.ex",
      "lib/plug/crypto/message_verifier.ex",
      "lib/plug/crypto/message_encryptor.ex"
    ],
    "collectionURL": "https://repo.hex.pm",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Plug.Crypto':verify/4"
      },
      {
        "name": "'Elixir.Plug.Crypto':decrypt/4"
      },
      {
        "name": "'Elixir.Plug.Crypto':secure_compare/2"
      },
      {
        "name": "'Elixir.Plug.Crypto':masked_compare/3"
      },
      {
        "name": "'Elixir.Plug.Crypto':mask/2"
      },
      {
        "name": "'Elixir.Plug.Crypto':sign/4"
      },
      {
        "name": "'Elixir.Plug.Crypto':encrypt/4"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageVerifier':sign/3"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageVerifier':verify/2"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageEncryptor':encrypt/4"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageEncryptor':decrypt/4"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:elixir-plug:plug_crypto:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-plug/plug_crypto",
    "vendor": "elixir-plug",
    "modules": [
      "'Elixir.Plug.Crypto'",
      "'Elixir.Plug.Crypto.MessageVerifier'",
      "'Elixir.Plug.Crypto.MessageEncryptor'"
    ],
    "product": "plug_crypto",
    "versions": [
      {
        "status": "affected",
        "version": "2d078b7b8264c565f0ff71235c515f4f46882dcf",
        "lessThan": "981887493dada0fce7003c61861c00dfbb0fc8c5",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/elixir-plug/plug_crypto",
    "packageName": "elixir-plug/plug_crypto",
    "programFiles": [
      "lib/plug/crypto.ex",
      "lib/plug/crypto/message_verifier.ex",
      "lib/plug/crypto/message_encryptor.ex"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Plug.Crypto':verify/4"
      },
      {
        "name": "'Elixir.Plug.Crypto':decrypt/4"
      },
      {
        "name": "'Elixir.Plug.Crypto':secure_compare/2"
      },
      {
        "name": "'Elixir.Plug.Crypto':masked_compare/3"
      },
      {
        "name": "'Elixir.Plug.Crypto':mask/2"
      },
      {
        "name": "'Elixir.Plug.Crypto':sign/4"
      },
      {
        "name": "'Elixir.Plug.Crypto':encrypt/4"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageVerifier':sign/3"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageVerifier':verify/2"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageEncryptor':encrypt/4"
      },
      {
        "name": "'Elixir.Plug.Crypto.MessageEncryptor':decrypt/4"
      }
    ]
  }
]

Related CVEs: CVE-2026-105963
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #52945 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 14:53:21 GMT
Publisher date: Fri, 23 Oct 2026 09:56:58 GMT

Read the original announcement

Revision history

25 Oct 2026CVE-2026-105963 · Revision 1Source updated