team-alembic ash_authentication Base62 Decoder base.ex AshAuthentication.Base.decode62 memory allocation

Summaryinfo

A vulnerability was found in team-alembic ash_authentication. It has been rated as problematic. This issue affects the function AshAuthentication.Base.decode62 of the file lib/ash_authentication/base.ex of the component Base62 Decoder. This manipulation causes memory allocation. The identification of this vulnerability is CVE-2026-82760. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in team-alembic ash_authentication (version unknown) and classified as problematic. Affected by this vulnerability is the function AshAuthentication.Base.decode62 of the file lib/ash_authentication/base.ex of the component Base62 Decoder. The manipulation with an unknown input leads to a memory allocation vulnerability. The CWE definition for the vulnerability is CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. As an impact it is known to affect availability. The summary by CVE is:

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-82760 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• team-alembic

Name

• ash_authentication

Website

• Product: https://github.com/team-alembic/ash_authentication/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion