EUVD-2026-81478Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated request to the pre-auth sign-in path (AV:N/PR:N/UI:N/AC:L) causes availability-only resource exhaustion (A:H), with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.
AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.
This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust server CPU and memory by submitting an API key containing an oversized base62 segment. Affected are ash_authentication releases from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14 that enable the ApiKey strategy; the malicious input is decoded before any key lookup, so no credentials, valid key, or user interaction is required (CVSS 4.0 base 8.2; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must use AshAuthentication with the ApiKey strategy enabled (AshAuthentication.Strategy.ApiKey.SignInPreparation exposed via a sign-in action), and run an affected version (4.8.0 up to but not including 4.15.0, or 5.0.0-rc.0 up to but not including 5.0.0-rc.14). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, network-reachable denial-of-service (CWE-407, algorithmic complexity) that a defender should prioritize if they run AshAuthentication's ApiKey strategy. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade ash_authentication to 4.15.0 or later on the 4.x line, or to 5.0.0-rc.14 or later on the 5.0 release-candidate line, following the advisory at https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx; the fixes are contained in the referenced upstream commits f3a53f480088419788d5c3934af3131fa9066773, d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e, and dfb19c897853686ab481c5e773f7a1a0c74dea04, so a deployment pinned to a git dependency can also pull one of those revisions directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of the ash_authentication package and determine which ones enable the ApiKey sign-in strategy; for any that are internet-facing, apply edge rate limiting on the sign-in endpoint or temporarily disable the ApiKey strategy until an upgrade window is available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoen
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity c
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.1
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today