Improper Authentication Flaw in AshAuthentication by Team Alembic
CVE-2026-118505

6.3MEDIUM

Key Information:

Vendor

Team-alembic

Status
Ash Authentication
Vendor
CVE Published:
3 November 2026

What is CVE-2026-118505?

The vulnerability in AshAuthentication allows unauthenticated attackers to exploit improper restrictions, enabling them to guess passwords and one-time passwords without any limitations. This flaw arises from the failure of the brute_force_strategy to apply necessary protections across certain actions defined within the resource. Specifically, actions related to password sign-in and OTP requests can be accessed without restrictions, particularly when the registration is enabled. Users are strongly advised to update to the patched version for enhanced security.

Affected Version(s)

ash_authentication 5.0.0-rc.4 < 5.0.0-rc.16

ash_authentication 800caa0d4a5bee1f28ad427f4c12fab72003a577 < 7117b5da5b73ee4cdb372e4adfbaff409b527125

References

https://github.com/team-alembic/ash_authentication/securi...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-118505.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-118505
related

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

azmaveth
azmaveth
azmaveth
Zach Daniel / Ash Project
.