ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-118505

AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Published Nov 3, 2026 · catalog updated Nov 3, 2026 · AshAuthentication brute_force_strategy does not

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-118505. EPSS is 0.58%. Act only if a listed version of AshAuthentication brute_force_strategy does not is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (AshAuthentication brute_force_strategy does not).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.58%
Remediation
Advisory link
Affected products
Hex ash_authentication

## Summary Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: writes , and , then adds to those strategies, and writes its OTP actions without the preparation. Separately, with the OTP sign-in is a create action, which preparations do not run on, so never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16. ## Workarounds Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For that is on the password sign-in, password reset request, magic link request and OTP request actions, and on a read OTP sign-in action. For it is . For OTP with , switch to . ## Configurations A password, magic link or OTP strategy sets and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets with . Actions the strategies generate themselves, and the OTP strategy's mode, are not affected.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex ash_authentication5.0.0-rc.4 → 5.0.0-rc.16

How to fix CVE-2026-118505

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-118505. EPSS is 0.58%. Act only if a listed version of AshAuthentication brute_force_strategy does not is installed.

Which versions are affected?

Compare what you have installed with 5.0.0-rc.4 → 5.0.0-rc.16. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-307: Improper Restriction of Excessive Authentication Attempts. EPSS 0.58%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 3, 2026 · GitHub Advisory Database

    Detected

    ## Summary Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as

  2. Nov 3, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 5.0.0-rc.16

  3. Nov 3, 2026 · GitHub Advisory Database

    Fix available

    ash_authentication fixed in 5.0.0-rc.16

  4. Nov 3, 2026 · GitHub Advisory Database

    Updated

    ## Summary Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as

Sources

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseNov 5, 2026
  • OpenSSF OSV / OSV ScannerNov 5, 2026
  • CVE.orgNov 4, 2026