EEF-CVE-2026-118505

Dashboard / Vulnerabilities / EEF-CVE-2026-118505

EEF-CVE-2026-118505

Summary: AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Details: ## Summary Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce `brute_force_strategy` by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: `mix ash_authentication.install` writes `sign_in_with_password`, `request_password_reset_token` and `request_magic_link`, `mix ash_authentication.upgrade` then adds `brute_force_strategy` to those strategies, and `mix ash_authentication.add_strategy.otp` writes its OTP actions without the preparation. Separately, with `registration_enabled? true` the OTP sign-in is a create action, which preparations do not run on, so `brute_force_strategy {:preparation, module}` never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16. ## Workarounds Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For `brute_force_strategy {:audit_log, name}` that is `prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action_name: <action>}` on the password sign-in, password reset request, magic link request and OTP request actions, and `prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action_name: <action>}` on a read OTP sign-in action. For `{:preparation, MyModule}` it is `prepare MyModule`. For OTP with `registration_enabled? true`, switch to `brute_force_strategy :rate_limit`. ## Configurations A password, magic link or OTP strategy sets `brute_force_strategy` and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets `registration_enabled? true` with `brute_force_strategy {:preparation, module}`. Actions the strategies generate themselves, and the OTP strategy's `:rate_limit` mode, are not affected.

References: https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-55gf-3263-4r39, https://cna.erlef.org/cves/CVE-2026-118505.html, https://github.com/team-alembic/ash_authentication/commit/800caa0d4a5bee1f28ad427f4c12fab72003a577, https://github.com/team-alembic/ash_authentication/commit/7117b5da5b73ee4cdb372e4adfbaff409b527125, https://hex.pm/packages/ash_authentication