{"id":"CVE-2026-82760","aliases":["GHSA-q876-xr24-2mcx"],"url":"https://o3.security/vulnerability/CVE-2026-82760","summary":"Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in","details":"## Summary\n\nInefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.\n\n`AshAuthentication.Base.decode62/1` in `lib/ash_authentication/base.ex` splits its argument into one binary per character and folds it with `charval62/2`, which recomputes `Integer.pow(62, index)` at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. `bindecode62/1` in the same module is quadratic through `Integer.undigits/2` and `Integer.digits/2`. Neither function caps `byte_size/1`, and `AshAuthentication.Strategy.ApiKey.SignInPreparation` passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding `rescue` clauses catch exceptions, not CPU or memory exhaustion.\n\nThis issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.","published":"2026-09-17T13:08:46.382Z","modified":"2026-09-17T13:26:04.780684193Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Hex","name":"ash_authentication","fixedVersion":"4.15.0"}],"fix":{"url":"https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e","label":"team-alembic/ash_authentication@d5a5d4c"},"references":[{"type":"ADVISORY","url":"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-82760.html"},{"type":"WEB","url":"https://github.com/team-alembic/ash_authentication/commit/f3a53f480088419788d5c3934af3131fa9066773"},{"type":"FIX","url":"https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e"},{"type":"FIX","url":"https://github.com/team-alembic/ash_authentication/commit/dfb19c897853686ab481c5e773f7a1a0c74dea04"},{"type":"PACKAGE","url":"https://hex.pm/packages/ash_authentication"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T13:26:04.780684193Z"}}