CVE-2026-118505

Name of the Vulnerable Software and Affected Versions ash authentication versions 5.0.0-rc.4 through 5.0.0-rc.15

Description An improper restriction of excessive authentication attempts allows an unauthenticated attacker to guess passwords and one-time passwords (OTP) without limit. This occurs because the brute force strategy is only applied to actions generated by the strategy; if a resource defines these actions manually, the restriction is not enforced. Specifically, actions created via mix ash authentication.install, mix ash authentication.upgrade, and mix ash authentication.add strategy.otp may lack the necessary preparation. Additionally, when registration enabled? is set to true, the OTP sign-in is treated as a create action, which bypasses preparations, rendering brute force strategy {:preparation, module} ineffective.

Recommendations For versions 5.0.0-rc.4 through 5.0.0-rc.15, add the brute-force preparation to each protected action defined on the resource or remove the manual action to allow the strategy to generate it. For brute force strategy {:audit log, name}, apply prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action name: <action>} to password sign-in, password reset request, magic link request, and OTP request actions, and apply prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action name: <action>} to read OTP sign-in actions. For {:preparation, MyModule}, apply prepare MyModule to the affected actions. For OTP configurations where registration enabled? is true, switch to brute force strategy :rate limit.