The vulnerability in ash_authentication's AshAuthentication.Base.decode62/1 function involves inefficient algorithmic complexity due to repeated recomputation of Integer.pow(62, index) instead of using an accumulated approach like Horner's method. This causes the CPU and memory cost to grow roughly cubically with the input length. Another function, bindecode62/1, is quadratic in complexity. Both functions do not limit the size of the input, and the API key segments are processed before any authentication or key lookup, allowing unauthenticated attackers to submit oversized inputs that exhaust system resources. Rescue clauses catch exceptions but do not mitigate CPU or memory exhaustion. This affects versions >=4.8.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14.

An unauthenticated attacker can cause denial of service by exhausting CPU and memory resources on systems using vulnerable versions of ash_authentication. This can degrade service availability or cause crashes due to resource exhaustion. There is no indication of data compromise or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing input size validation or rate limiting on API key submissions to mitigate resource exhaustion risks. Monitor for unusually large API key segments and block or throttle such requests.