Description
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.

The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it.

This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.
Published: 2026-11-03
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthenticated brute‑force password and OTP guessing
Action: Apply Fix
AI Analysis

Impact

The vulnerability resides in the enforcement of brute‑force protection in Ash Authentication. When a resource defines actions that are intended to be protected by the library’s brute‑force strategy, the strategy’s preparation step is omitted, allowing an attacker to attempt unlimited password or OTP guesses without restriction. This flaw can lead to unauthorized account access or compromise of single‑use credentials (e.g., OTPs).

Affected Systems

The issue affects the team‑alembic Ash Authentication library in versions from 5.0.0‑rc.4 up through 5.0.0‑rc.15. Versions 5.0.0‑rc.16 and later contain a remedial change that correctly attaches the brute‑force preparation to the relevant actions.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity level. The exploit probability is currently not published, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can launch the attack from any network location that can reach the authentication endpoints, using standard HTTP requests to submit credentials. The lack of rate limiting provides a straightforward path to credential discovery without additional prerequisites.

Generated by OpenCVE AI on November 3, 2026 at 17:26 UTC.

Remediation

Vendor Workaround

Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For brute_force_strategy {:audit_log, name} that is prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action_name: <action>} on the password sign-in, password reset request, magic link request and OTP request actions, and prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action_name: <action>} on a read OTP sign-in action. For {:preparation, MyModule} it is prepare MyModule. For OTP with registration_enabled? true, switch to brute_force_strategy :rate_limit.

OpenCVE Recommended Actions

  • Upgrade team‑alembic Ash Authentication to version 5.0.0‑rc.16 or later where the brute‑force strategy is applied correctly.
  • If an upgrade is not immediately possible, add the brute‑force preparation to every protected action defined on the resource per the CNA workaround: for password and OTP actions use the appropriate AshAuthentication.AddOn.AuditLog Preparation modules, and for OTP with registration_enabled? true switch to the rate_limit brute‑force strategy.
  • Ensure that OTP sign‑in actions, especially create actions, invoke the brute‑force preparation by configuring the strategy with :rate_limit when registration_enabled? is true.

Generated by OpenCVE AI on November 3, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.
Title AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-307
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-11-03T17:48:03.096Z

Reserved: 2026-10-29T16:15:02.036Z

Link: CVE-2026-118505

cve-icon Vulnrichment

Updated: 2026-11-03T17:47:54.284Z

cve-icon NVD

Status : Deferred

Published: 2026-11-03T16:17:20.043

Modified: 2026-11-03T18:17:55.010

Link: CVE-2026-118505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T20:45:01Z

Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts