Executive brief
AshAuthentication is an authentication library used in Elixir-based applications. An unauthenticated attacker can exploit inefficient base62 decoding functions to consume excessive CPU and memory by submitting an oversized API key, causing the service to become unresponsive or crash without requiring any valid credentials.
Technical details
The vulnerability exists in the base62 decoding functions (decode62/1 and bindecode62/1) in lib/ash_authentication/base.ex, which use inefficient algorithms that exhibit cubic and quadratic complexity respectively relative to input length. The functions do not validate input size before processing, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes unsanitized, underscore-separated API key segments directly to these decoders without authentication or key lookup validation. An attacker can craft a malicious API key with oversized base62 segments to trigger CPU and memory exhaustion; the surrounding exception handlers do not catch resource exhaustion conditions, only exceptions. The issue affects ash_authentication versions 4.8.0 through 4.14.x and 5.0.0-rc.0 through 5.0.0-rc.13.
Affected products
- team-alembic AshAuthentication 4.8.0 to 4.14.x, 5.0.0-rc.0 to 5.0.0-rc.13
Timeline
- 2026-09-17: disclosed