EEF-CVE-2026-82760

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

## Summary Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. `AshAuthentication.Base.decode62/1` in `lib/ash_authentication/base.ex` splits its argument into one binary per character and folds it with `charval62/2`, which recomputes `Integer.pow(62, index)` at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. `bindecode62/1` in the same module is quadratic through `Integer.undigits/2` and `Integer.digits/2`. Neither function caps `byte_size/1`, and `AshAuthentication.Strategy.ApiKey.SignInPreparation` passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding `rescue` clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.