Skip to content
Fencer Vulns
medium 6.3

CVE-2026-118505 json

AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

published 2026-11-03 5 d ago modified 2026-11-03 5 d ago also EEF-CVE-2026-118505 , GHSA-55gf-3263-4r39 , EUVD-2026-116025

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.

The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it.

This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.

Patch / fix

  • hex ash_authentication 5.0.0-rc.16
  • team-alembic ash_authentication 5.0.0-rc.16

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 d ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
hex ash_authentication
>=5.0.0-rc.4, <5.0.0-rc.16
5.0.0-rc.16

Affected products

  • team-alembic ash_authentication

Classification

Weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.