AshAuthentication CVE-2026-118505

Exploitation requires the application to configure brute_force_strategy on a password, magic-link or OTP strategy AND for at least one protected action (password sign-in, password reset request, magic link request, OTP sign-in, OTP request) to be defined on the resource itself without the matching AshAuthentication.AddOn.AuditLog preparation. This is exactly the state produced by the generators - mix ash_authentication.install plus mix ash_authentication.upgrade for password/magic-link actions, and mix ash_authentication.add_strategy.otp for OTP actions - so default-scaffolded resources are affected. Additionally, OTP with registration_enabled? true and brute_force_strategy {:preparation, module} is affected because its sign-in is a create action on which preparations never run. LIMITING FACTORS: only ash_authentication 5.0.0-rc.4 through rc.15 are vulnerable; actions the strategy generates itself DO carry the preparation and are not affected; and the OTP strategy's brute_force_strategy :rate_limit (checked per action via ash_rate_limiter) is not affected. Note the audit-log batching default can also delay failure counting by up to ten seconds unless write_batching enabled? false is set.

This is a genuine but moderate-priority authentication-hardening flaw, not a critical remote-code issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N, score 6.3 Medium) is internally consistent with the description: an unauthenticated network attacker (PR:N) can abuse the missing rate limit, but impact is only partial (VC:L/VI:L) because the outcome is account takeover via guessing rather than direct data or system compromise, and the AT:P requirement reflects that a specific configuration/action layout must be present. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the vuln.today decision label is 'this_month' (not act_now/emergency), which matches a fixable, non-emergency issue. No working exploit code is supplied (only vendor advisory and patch-commit references), so this is 'no public exploit identified at time of analysis.' The main caveat: real-world exploitability hinges on the OTP case - a short numeric one-time password guessable without limit for its full validity window is practically brute-forceable, which is the most serious concrete risk here; password guessing is throttled only by password strength. Because EPSS/KEV data is simply absent (not low), risk ranking relies on the CVSS signal plus the vendor's own 'this_month' triage.

An unauthenticated attacker targets an Elixir/Phoenix application built on ash_authentication (5.0.0-rc.4 through rc.15) whose sign-in, password-reset, magic-link or OTP actions were written onto the user resource by the generators, where the brute_force_strategy preparation was never actually applied. The attacker repeatedly submits password or one-time-password guesses against a known account with no lockout or throttling; a numeric OTP can be exhaustively guessed for the entire time it remains valid, enabling account takeover. No public exploit code is identified at time of analysis.