Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118505— AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 （属于 项目）中存在“未对过度认证尝试实施限制”的漏洞，使得未认证的攻击者可以无限制地猜测密码和一次性密码（OTP）。 密码、魔法链接和 OTP 认证策略本应通过 实施暴力破解防护，但该机制仅在它们生成的操作（actions）上添加必要的“准备步骤”（preparation）。然而，当资源自行定义了这些操作时，策略会直接使用其定义内容，而系统未检查该操作是否包含了所需的准备步骤，导致配置虽被编译却未实际施加限制。 具体而言： 会生成 、 和 等操作； 随后为这些策略添加 ； 而 在生成 OTP 相关操作时，却未

CVSS 6.3 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
team-alembic ash_authentication 5.0.0-rc.4< 5.0.0-rc.16 affected
800caa0d4a5bee1f28ad427f4c12fab72003a577< 7117b5da5b73ee4cdb372e4adfbaff409b527125 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118505

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 5.0.0-rc.4 ~ 5.0.0-rc.16 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication 800caa0d4a5bee1f28ad427f4c12fab72003a577 ~ 7117b5da5b73ee4cdb372e4adfbaff409b527125 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-118505

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118505

请登录查看更多情报信息。

Other References for CVE-2026-118505 (5)

Same Patch Batch · team-alembic · 2026-11-03 · 3 CVEs total

CVE-2026-119215 7.6 HIGH AshAuthentication TOTP setup lets a user install their own authenticator secret on another
CVE-2026-110826 6.3 MEDIUM AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-a

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-307