CVE-2026-118505
Deferred Deferred - Pending Action

Brute Force Authentication Bypass in ash_authentication

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: EEF

Description
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-118505
EUVD
EUVD-2026-116025

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
team-alembic ash_authentication 5.0.0-rc.4
team-alembic ash_authentication 800caa0d4a5bee1f28ad427f4c12fab72003a577

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Restriction of Excessive Authentication Attempts in the AshAuthentication library. It allows unauthenticated attackers to bypass rate-limiting protections and perform brute force attacks on password, magic link, and one-time password (OTP) authentication mechanisms. The issue occurs because the brute_force_strategy, designed to prevent excessive login attempts, is not properly enforced when authentication actions are defined directly on the resource instead of being generated by the strategy.

Detection Guidance

Check if your AshAuthentication version is between 5.0.0-rc.4 and 5.0.0-rc.15. Review authentication logs for excessive failed attempts on password, magic link, or OTP actions. Look for actions manually defined on resources without brute-force preparations.

Impact Analysis

An attacker could exploit this to guess passwords or OTPs indefinitely, potentially gaining unauthorized access to user accounts. This could lead to data breaches, account takeovers, or other malicious activities depending on the system's sensitivity. The impact is higher if the system handles sensitive data like user credentials or personal information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by failing to implement adequate security measures to protect user authentication. GDPR requires appropriate technical measures to ensure data security, while HIPAA mandates safeguards against unauthorized access. Exploiting this flaw may result in unauthorized data access, violating these regulations.

Mitigation Strategies

Upgrade to AshAuthentication 5.0.0-rc.16 or later. Manually add brute-force preparations to affected actions or switch OTP strategies to :rate_limit if registration is enabled. Delete manually defined actions to allow strategy-generated ones with protections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...