CVE-2026-82760 (GCVE-0-2026-82760)
Vulnerability from cvelistv5 – Published: 2026-09-17 13:08 – Updated: 2026-09-17 18:21
VLAI
EPSS
VEX
Title
Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
Summary
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.
AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.
This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:21 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| team-alembic | ash_authentication |
Affected:
4.8.0 , < 4.15.0
(semver)
Affected: 5.0.0-rc.0 , < 5.0.0-rc.14 (semver) cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* |
||
| team-alembic | ash_authentication |
Affected:
f3a53f480088419788d5c3934af3131fa9066773 , < *
(git)
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:21:05.949151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:21:26.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Base\u0027",
"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027"
],
"packageName": "ash_authentication",
"packageURL": "pkg:hex/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/base.ex",
"lib/ash_authentication/strategies/api_key/sign_in_preparation.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Base\u0027:decode62/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Base\u0027:bindecode62/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027:prepare/3"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"lessThan": "4.15.0",
"status": "affected",
"version": "4.8.0",
"versionType": "semver"
},
{
"lessThan": "5.0.0-rc.14",
"status": "affected",
"version": "5.0.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Base\u0027",
"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027"
],
"packageName": "team-alembic/ash_authentication",
"packageURL": "pkg:github/team-alembic/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/base.ex",
"lib/ash_authentication/strategies/api_key/sign_in_preparation.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Base\u0027:decode62/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Base\u0027:bindecode62/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027:prepare/3"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"changes": [
{
"at": "d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e",
"status": "unaffected"
},
{
"at": "dfb19c897853686ab481c5e773f7a1a0c74dea04",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "f3a53f480088419788d5c3934af3131fa9066773",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.15.0",
"versionStartIncluding": "4.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.0-rc.14",
"versionStartIncluding": "5.0.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "James Harton"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-09-11T17:59:54.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Base.decode62/1\u003c/code\u003e in \u003ccode\u003elib/ash_authentication/base.ex\u003c/code\u003e splits its argument into one binary per character and folds it with \u003ccode\u003echarval62/2\u003c/code\u003e, which recomputes \u003ccode\u003eInteger.pow(62, index)\u003c/code\u003e at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. \u003ccode\u003ebindecode62/1\u003c/code\u003e in the same module is quadratic through \u003ccode\u003eInteger.undigits/2\u003c/code\u003e and \u003ccode\u003eInteger.digits/2\u003c/code\u003e. Neither function caps \u003ccode\u003ebyte_size/1\u003c/code\u003e, and \u003ccode\u003eAshAuthentication.Strategy.ApiKey.SignInPreparation\u003c/code\u003e passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding \u003ccode\u003erescue\u003c/code\u003e clauses catch exceptions, not CPU or memory exhaustion.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\n\n`AshAuthentication.Base.decode62/1` in `lib/ash_authentication/base.ex` splits its argument into one binary per character and folds it with `charval62/2`, which recomputes `Integer.pow(62, index)` at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. `bindecode62/1` in the same module is quadratic through `Integer.undigits/2` and `Integer.digits/2`. Neither function caps `byte_size/1`, and `AshAuthentication.Strategy.ApiKey.SignInPreparation` passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding `rescue` clauses catch exceptions, not CPU or memory exhaustion.\n\nThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
}
],
"value": "Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\n\nAshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.\n\nThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:08:46.382Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx"
},
{
"name": "EEF CNA record for CVE-2026-82760",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82760.html"
},
{
"name": "OSV record EEF-CVE-2026-82760",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82760"
},
{
"name": "Introducing commit f3a53f4 in team-alembic/ash_authentication",
"tags": [
"related"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/f3a53f480088419788d5c3934af3131fa9066773"
},
{
"name": "Fix commit d5a5d4c in team-alembic/ash_authentication",
"tags": [
"patch"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e"
},
{
"name": "Fix commit dfb19c8 in team-alembic/ash_authentication",
"tags": [
"patch"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/dfb19c897853686ab481c5e773f7a1a0c74dea04"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82760",
"datePublished": "2026-09-17T13:08:46.382Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-17T18:21:26.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-82760\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-17T14:17:33.237\",\"lastModified\":\"2026-09-17T19:17:04.490\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\\n\\nAshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.\\n\\nThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"team-alembic\",\"product\":\"ash_authentication\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash_authentication\",\"cpes\":[\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshAuthentication.Base\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027\"],\"programFiles\":[\"lib/ash_authentication/base.ex\",\"lib/ash_authentication/strategies/api_key/sign_in_preparation.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshAuthentication.Base\u0027:decode62/1\"},{\"name\":\"\u0027Elixir.AshAuthentication.Base\u0027:bindecode62/1\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027:prepare/3\"}],\"repo\":\"https://github.com/team-alembic/ash_authentication\",\"packageURL\":\"pkg:hex/ash_authentication\",\"versions\":[{\"version\":\"4.8.0\",\"lessThan\":\"4.15.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0.0-rc.0\",\"lessThan\":\"5.0.0-rc.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"team-alembic\",\"product\":\"ash_authentication\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"team-alembic/ash_authentication\",\"cpes\":[\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshAuthentication.Base\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027\"],\"programFiles\":[\"lib/ash_authentication/base.ex\",\"lib/ash_authentication/strategies/api_key/sign_in_preparation.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshAuthentication.Base\u0027:decode62/1\"},{\"name\":\"\u0027Elixir.AshAuthentication.Base\u0027:bindecode62/1\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027:prepare/3\"}],\"repo\":\"https://github.com/team-alembic/ash_authentication\",\"packageURL\":\"pkg:github/team-alembic/ash_authentication\",\"versions\":[{\"version\":\"f3a53f480088419788d5c3934af3131fa9066773\",\"lessThan\":\"*\",\"versionType\":\"git\",\"status\":\"affected\",\"changes\":[{\"at\":\"d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e\",\"status\":\"unaffected\"},{\"at\":\"dfb19c897853686ab481c5e773f7a1a0c74dea04\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-17T18:21:05.949151Z\",\"id\":\"CVE-2026-82760\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-407\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82760.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/dfb19c897853686ab481c5e773f7a1a0c74dea04\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/f3a53f480088419788d5c3934af3131fa9066773\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82760\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"affected\": [{\"collectionURL\": \"https://repo.hex.pm\", \"cpes\": [\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unaffected\", \"modules\": [\"\u0027Elixir.AshAuthentication.Base\u0027\", \"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027\"], \"packageName\": \"ash_authentication\", \"packageURL\": \"pkg:hex/ash_authentication\", \"product\": \"ash_authentication\", \"programFiles\": [\"lib/ash_authentication/base.ex\", \"lib/ash_authentication/strategies/api_key/sign_in_preparation.ex\"], \"programRoutines\": [{\"name\": \"\u0027Elixir.AshAuthentication.Base\u0027:decode62/1\"}, {\"name\": \"\u0027Elixir.AshAuthentication.Base\u0027:bindecode62/1\"}, {\"name\": \"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027:prepare/3\"}], \"repo\": \"https://github.com/team-alembic/ash_authentication\", \"vendor\": \"team-alembic\", \"versions\": [{\"lessThan\": \"4.15.0\", \"status\": \"affected\", \"version\": \"4.8.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.0.0-rc.14\", \"status\": \"affected\", \"version\": \"5.0.0-rc.0\", \"versionType\": \"semver\"}]}, {\"collectionURL\": \"https://github.com\", \"cpes\": [\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unaffected\", \"modules\": [\"\u0027Elixir.AshAuthentication.Base\u0027\", \"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027\"], \"packageName\": \"team-alembic/ash_authentication\", \"packageURL\": \"pkg:github/team-alembic/ash_authentication\", \"product\": \"ash_authentication\", \"programFiles\": [\"lib/ash_authentication/base.ex\", \"lib/ash_authentication/strategies/api_key/sign_in_preparation.ex\"], \"programRoutines\": [{\"name\": \"\u0027Elixir.AshAuthentication.Base\u0027:decode62/1\"}, {\"name\": \"\u0027Elixir.AshAuthentication.Base\u0027:bindecode62/1\"}, {\"name\": \"\u0027Elixir.AshAuthentication.Strategy.ApiKey.SignInPreparation\u0027:prepare/3\"}], \"repo\": \"https://github.com/team-alembic/ash_authentication\", \"vendor\": \"team-alembic\", \"versions\": [{\"changes\": [{\"at\": \"d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e\", \"status\": \"unaffected\"}, {\"at\": \"dfb19c897853686ab481c5e773f7a1a0c74dea04\", \"status\": \"unaffected\"}], \"lessThan\": \"*\", \"status\": \"affected\", \"version\": \"f3a53f480088419788d5c3934af3131fa9066773\", \"versionType\": \"git\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.15.0\", \"versionStartIncluding\": \"4.8.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.0.0-rc.14\", \"versionStartIncluding\": \"5.0.0-rc.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"James Harton\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"dateAssigned\": \"2026-09-11T17:59:54.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eInefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Base.decode62/1\u003c/code\u003e in \u003ccode\u003elib/ash_authentication/base.ex\u003c/code\u003e splits its argument into one binary per character and folds it with \u003ccode\u003echarval62/2\u003c/code\u003e, which recomputes \u003ccode\u003eInteger.pow(62, index)\u003c/code\u003e at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. \u003ccode\u003ebindecode62/1\u003c/code\u003e in the same module is quadratic through \u003ccode\u003eInteger.undigits/2\u003c/code\u003e and \u003ccode\u003eInteger.digits/2\u003c/code\u003e. Neither function caps \u003ccode\u003ebyte_size/1\u003c/code\u003e, and \u003ccode\u003eAshAuthentication.Strategy.ApiKey.SignInPreparation\u003c/code\u003e passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding \u003ccode\u003erescue\u003c/code\u003e clauses catch exceptions, not CPU or memory exhaustion.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e\"}, {\"base64\": false, \"type\": \"text/markdown\", \"value\": \"Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\\n\\n`AshAuthentication.Base.decode62/1` in `lib/ash_authentication/base.ex` splits its argument into one binary per character and folds it with `charval62/2`, which recomputes `Integer.pow(62, index)` at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. `bindecode62/1` in the same module is quadratic through `Integer.undigits/2` and `Integer.digits/2`. Neither function caps `byte_size/1`, and `AshAuthentication.Strategy.ApiKey.SignInPreparation` passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding `rescue` clauses catch exceptions, not CPU or memory exhaustion.\\n\\nThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\"}], \"value\": \"Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\\n\\nAshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner\u0027s method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.\\n\\nThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"attackVector\": \"NETWORK\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"providerUrgency\": \"NOT_DEFINED\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-407\", \"description\": \"CWE-407 Inefficient Algorithmic Complexity\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-17T13:08:46.382Z\"}, \"references\": [{\"tags\": [\"related\", \"vendor-advisory\"], \"url\": \"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx\"}, {\"name\": \"EEF CNA record for CVE-2026-82760\", \"tags\": [\"related\"], \"url\": \"https://cna.erlef.org/cves/CVE-2026-82760.html\"}, {\"name\": \"OSV record EEF-CVE-2026-82760\", \"tags\": [\"related\"], \"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-82760\"}, {\"name\": \"Introducing commit f3a53f4 in team-alembic/ash_authentication\", \"tags\": [\"related\"], \"url\": \"https://github.com/team-alembic/ash_authentication/commit/f3a53f480088419788d5c3934af3131fa9066773\"}, {\"name\": \"Fix commit d5a5d4c in team-alembic/ash_authentication\", \"tags\": [\"patch\"], \"url\": \"https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e\"}, {\"name\": \"Fix commit dfb19c8 in team-alembic/ash_authentication\", \"tags\": [\"patch\"], \"url\": \"https://github.com/team-alembic/ash_authentication/commit/dfb19c897853686ab481c5e773f7a1a0c74dea04\"}], \"source\": {\"discovery\": \"INTERNAL\"}, \"title\": \"Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in\"}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82760\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-17T18:21:05.949151Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-17T18:21:18.679Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-82760\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"EEF\", \"dateReserved\": \"2026-08-31T01:00:10.817Z\", \"datePublished\": \"2026-09-17T13:08:46.382Z\", \"dateUpdated\": \"2026-09-17T18:21:26.238Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…