CVE-2026-82760highCWE-407

CVE-2026-82760: falha de alta gravidade em team-alembic ash_authentication

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Publicada em

Seguir esta CVE+ Monitorar ash authentication+ Monitorar ash_authentication

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.7%
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
team-alembic · ash_authentication
CVEs relacionadas — team-alembic ash_authentication

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86533CRITICALRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEPSS 0.9%CVE-2026-76949CRITICALRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementEPSS 0.8%CVE-2026-85500CRITICAL`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationEPSS 0.8%CVE-2026-66882LOWReflected XSS in AshAuthentication confirmation and magic link interaction formsEPSS 0.8%CVE-2026-88952CRITICALOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationEPSS 0.7%CVE-2026-86688HIGHSession id is not renewed on authentication in ash_authentication, allowing session fixationEPSS 0.7%