CVE-2026-82760: AshAuthentication API Key Sign-In Vulnerability Leading to Resource Exhaustion
Summary
CVE-2026-82760: Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in. Affects ash_authentication across 4 version ranges.
>= 4.8.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
< dfb19c897853686ab481c5e773f7a1a0c74dea04
>= f3a53f480088419788d5c3934af3131fa9066773, < d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is a package developed by team-alembic that provides authentication mechanisms for applications using API keys. It allows developers to implement secure sign-in processes for users. However, the package has a vulnerability that can be exploited by attackers to exhaust system resources, leading to potential denial of service.
Vulnerability Detail
The vulnerability arises from an inefficient algorithmic complexity in the AshAuthentication package, specifically in the method AshAuthentication.Base.decode62/1. This method splits its input into individual characters and recalculates powers of 62 for each character, leading to a cubic growth in processing time relative to input length. An attacker can exploit this by submitting an oversized base62 segment in an API key, causing excessive CPU and memory usage. The functions involved do not limit the size of the input, allowing for potential resource exhaustion without prior authentication checks.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.8.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to limit the size of the API key segments before they are processed by the decode62/1 and bindecode62/1 functions. This can help mitigate the risk of resource exhaustion until the package is updated.
Conclusion
CVE-2026-82760 represents a significant vulnerability in the AshAuthentication package that can lead to resource exhaustion. It is crucial for developers using this package to update to the latest patched versions to mitigate the risk. Implementing input validation can serve as a temporary measure until the update is completed.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-82760 is a vulnerability in the AshAuthentication package that allows attackers to exhaust CPU and memory resources through oversized API key segments.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
The vulnerability affects AshAuthentication versions from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
If immediate updates are not possible, implement input validation to restrict the size of API key segments as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
