TI-2026-84394 Aliases CVE-2026-118505

Missing sign-in attempt limit in AshAuthentication custom actions

LOW 29CWE-307Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-307.

Summary

The team-alembic ash_authentication package from 5.0.0-rc.4 before 5.0.0-rc.16 silently applies brute_force_strategy without enforcing it on sign-in and request actions that a resource defines itself. Those actions receive no attempt limit, and the flaw is tracked as CWE-307. An unauthenticated remote attacker can guess passwords and one-time passwords without limit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00576 47th percentileScored 2026-11-07

Fix Fixed ash_authentication (team-alembic): 5.0.0-rc.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
team-alembic	ash_authentication	5.0.0-rc.4 to before 5.0.0-rc.16	5.0.0-rc.16	Patch available	CNA

ash_authentication Vendorteam-alembic Affected 5.0.0-rc.4 to before 5.0.0-rc.16 Fixed in 5.0.0-rc.16 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:team-alembic:ash_authentication::::::::	—	—	—

cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade ash_authentication to 5.0.0-rc.16, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA ash_authentication (team-alembic) Fixed in 5.0.0-rc.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-11-03
team-alembic ash_authentication 5.0.0-rc.16
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-84395 TOTP setup in AshAuthentication lets users take over others' accountsPriority LOW 36
Show all 2 records →

Timeline

2026-11-03 Threatist record created from CVE-2026-118505
2026-11-03 CISA SSVC decision points changed
2026-11-03 Priority changed: MEDIUM → LOW

References

Patch 1

Fix commit 7117b5d in team-alembic/ash_authentication

Advisory 1

`brute_force_strategy` in AshAuthentication does not protect sign-in and request actions defined on the resource, allowing unlimited password and one-time password guessing

Other 3

TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences