Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82760— Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AshAuthentication 中的 team-alembic 模块存在“低效算法复杂度”漏洞：未认证的 attackers 可以通过在提交的 API Key 中嵌入一个超长的 base62 片段，从而耗尽 CPU 和内存资源。 具体而言， 中的 会将输入字符串按字符拆分为二元组，并通过 进行折叠处理。该方法在每个位置都重新计算 ，而未采用霍纳法则进行累积计算，导致处理时间随输入长度呈近似立方级增长。同一模块中的 因使用 和 ，其复杂度为平方级。这两个函数均未对 设置上限，而 会将提交的密钥中以下划线分隔的各段

CVSS 8.2 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82760

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
Source: CVE Program / CVE List V5
Vulnerability Description
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 4.8.0 ~ 4.15.0 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication f3a53f480088419788d5c3934af3131fa9066773 ~ * cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82760

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82760

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82760 (2)

Vendor Advisories for CVE-2026-82760 (2)

Vendor Pages for CVE-2026-82760 (1)

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

CVE-2026-82761 9.1 CRITICAL Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533 9.1 CRITICAL Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-85500 9.1 CRITICAL `require_confirmed_with` is not enforced on the action and fails open on an unreadable att
CVE-2026-88952 9.1 CRITICAL OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-91039 9.1 CRITICAL dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c
CVE-2026-82685 7.6 HIGH Confirmation token accepted on any record in AshAuthentication
CVE-2026-80218 7.6 HIGH Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-81632 7.2 HIGH Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223 6.9 MEDIUM Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522 6.3 MEDIUM Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-81637 2.3 LOW Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-82723 1.8 LOW Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759 1.8 LOW Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-407

V. Comments for CVE-2026-82760

No comments yet

Leave a comment