The vulnerability stems from a bug in the Cloak.Ecto.PBKDF2 implementation where the configured iteration count is ignored. Instead of using the configured 600 000 iterations, the algorithm uses only 32 rounds defined by the :size parameter. This dramatically reduces the computational cost of cracking stored password hashes, allowing an adversary who has the hash and the secret to brute‑force low‑entropy plaintexts approximately 18,750 times faster. Consequently, confidentiality of user credentials is severely compromised.

The flaw exists in the danielberkompas cloak_ecto library from version 1.0.0‑alpha.0 onward and in the cloak library from version 0.7.0 up to, but excluding, 1.0.0‑alpha.0. Systems using either package in these releases are vulnerable.

With a CVSS score of 6.3 the flaw presents a moderate severity risk. The EPSS score is below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is offline; an attacker who obtains the hashed values and the configured secret can perform a brute‑force search with dramatically lower effort. As the vulnerability is a Password Hash With Insufficient Computational Effort, it directly weakens the integrity of authentication mechanisms.