CVE-2026-118505: AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Summary

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.

The password, magic link and OTP strategies enforce bruteforcestrategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ashauthentication.install writes signinwithpassword, requestpasswordresettoken and requestmagiclink, mix ashauthentication.upgrade then adds bruteforcestrategy to those strategies, and mix ashauthentication.addstrategy.otp writes its OTP actions without the preparation. Separately, with registrationenabled? true the OTP sign-in is a create action, which preparations do not run on, so bruteforcestrategy {:preparation, module} never applied to it.

This issue affects ashauthentication: from 5.0.0-rc.4 before 5.0.0-rc.16.

Workarounds

Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For bruteforcestrategy {:auditlog, name} that is prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, actionname: <action>} on the password sign-in, password reset request, magic link request and OTP request actions, and prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, actionname: <action>} on a read OTP sign-in action. For {:preparation, MyModule} it is prepare MyModule. For OTP with registrationenabled? true, switch to bruteforcestrategy :ratelimit.

Configurations

A password, magic link or OTP strategy sets bruteforcestrategy and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets registrationenabled? true with bruteforcestrategy {:preparation, module}. Actions the strategies generate themselves, and the OTP strategy's :ratelimit mode, are not affected.