CVE-2026-82760

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

• CWE-407

• https://cna.erlef.org/cves/CVE-2026-82760.html
• https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e
• https://github.com/team-alembic/ash_authentication/commit/dfb19c897853686ab481c5e773f7a1a0c74dea04
• https://github.com/team-alembic/ash_authentication/commit/f3a53f480088419788d5c3934af3131fa9066773
• https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx
• https://osv.dev/vulnerability/EEF-CVE-2026-82760

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82755Use of Cache Containing Sensitive Information vulnerability …6.3
• CVE-2026-82756Improper Encoding or Escaping of Output vulnerability in ash…6.3
• CVE-2026-82757Server-Side Request Forgery (SSRF) vulnerability in ash-proj…6.3
• CVE-2026-82758Improper Authentication vulnerability in ash-project ash_aut…6.3
• CVE-2026-82759Use of a One-Way Hash with a Predictable Salt vulnerability …1.8
• CVE-2026-8276A flaw has been found in bettercap up to 2.41.5. Affected by…3.7
• CVE-2026-82761Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabil…9.1
• CVE-2026-82762Improper neutralization of special elements used in an OS co…8.8
• CVE-2026-82763Cross-site scripting vulnerability exists in Contec FX5000 s…5.4
• CVE-2026-82764Cross-site request forgery vulnerability exists in multiple …5.1
• CVE-2026-82765Path traversal vulnerability exists in Contec FX5000 series,…8.1
• CVE-2026-82766Improper neutralization of special elements used in an OS co…8.8