Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities found for ash_authentication_oauth2_server by ash-project
CVE-2026-82758 (GCVE-0-2026-82758)
Vulnerability from nvd – Published: 2026-09-07 22:32 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Summary
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82758.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82758 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < 30a87101871775d27d79f9ad6f29eafa4779e118
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:40:53.437993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:06.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "30a87101871775d27d79f9ad6f29eafa4779e118",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the server configures an \u003ccode\u003einitial_access_token\u003c/code\u003e (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (\u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e) or an \u003ccode\u003e{:error, _}\u003c/code\u003e for it, rather than a non-empty binary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the server configures an `initial_access_token` (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (`nil`, `false`, or `\"\"`) or an `{:error, _}` for it, rather than a non-empty binary."
}
],
"value": "Reachable only when the server configures an initial_access_token (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (nil, false, or \"\") or an {:error, _} for it, rather than a non-empty binary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_secret/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server\u003c/code\u003e (reached through \u003ccode\u003e__resolve_secret__!\u003c/code\u003e) treated any return other than \u003ccode\u003e{:ok, _}\u003c/code\u003e or \u003ccode\u003e:error\u003c/code\u003e from a configured \u003ccode\u003e{module, function, args}\u003c/code\u003e or 2-arity-function secret provider as a valid secret, wrapping \u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e as \u003ccode\u003e{:ok, value}\u003c/code\u003e. When the \u003ccode\u003einitial_access_token\u003c/code\u003e resolves to such an empty value, \u003ccode\u003ePOST /oauth/register\u003c/code\u003e compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as \u003ccode\u003esigning_secret\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\n`resolve_secret/3` in `AshAuthentication.Oauth2Server` (reached through `__resolve_secret__!`) treated any return other than `{:ok, _}` or `:error` from a configured `{module, function, args}` or 2-arity-function secret provider as a valid secret, wrapping `nil`, `false`, or `\"\"` as `{:ok, value}`. When the `initial_access_token` resolves to such an empty value, `POST /oauth/register` compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as `signing_secret`.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\nresolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or \"\" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:32:17.027Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82758",
"datePublished": "2026-09-07T22:32:17.027Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:06.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82757 (GCVE-0-2026-82757)
Vulnerability from nvd – Published: 2026-09-07 22:31 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82757 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 268b591261a3473ab9b87272963e4dd2fd99d972
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:50.818031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:57.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "268b591261a3473ab9b87272963e4dd2fd99d972",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when Client ID Metadata Documents are enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when Client ID Metadata Documents are enabled (`cimd_enabled?: true`), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"value": "Reachable only when Client ID Metadata Documents are enabled (cimd_enabled?: true), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003epublic_ip?/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD.ReqFetcher\u003c/code\u003e enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible \u003ccode\u003e::/96\u003c/code\u003e (for example \u003ccode\u003e::127.0.0.1\u003c/code\u003e), SIIT IPv4-translated \u003ccode\u003e::ffff:0:0:0/96\u003c/code\u003e, and deprecated site-local \u003ccode\u003efec0::/10\u003c/code\u003e. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\n`public_ip?/1` in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible `::/96` (for example `::127.0.0.1`), SIIT IPv4-translated `::ffff:0:0:0/96`, and deprecated site-local `fec0::/10`. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\npublic_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:31:34.656Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wprp-8gvj-p6cv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/268b591261a3473ab9b87272963e4dd2fd99d972"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82757",
"datePublished": "2026-09-07T22:31:34.656Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:57.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82756 (GCVE-0-2026-82756)
Vulnerability from nvd – Published: 2026-09-07 22:30 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.
BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82756.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82756 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 09f97476715da031b136eaec7b2cda2363ad8149
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:23.093058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:33.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "09f97476715da031b136eaec7b2cda2363ad8149",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, \u003ccode\u003eHost\u003c/code\u003e, path, or header) and uses \u003ccode\u003eBearerPlug\u003c/code\u003e or \u003ccode\u003eRequireScopePlug\u003c/code\u003e; the tenant reaches the challenge through the server\u0027s tenant-aware \u003ccode\u003eresource_url\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, `Host`, path, or header) and uses `BearerPlug` or `RequireScopePlug`; the tenant reaches the challenge through the server\u0027s tenant-aware `resource_url`."
}
],
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Host, path, or header) and uses BearerPlug or RequireScopePlug; the tenant reaches the challenge through the server\u0027s tenant-aware resource_url."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the \u003ccode\u003eWWW-Authenticate\u003c/code\u003e challenge header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBearerPlug\u003c/code\u003e and \u003ccode\u003eRequireScopePlug\u003c/code\u003e built the \u003ccode\u003eBearer resource_metadata=\"...\"\u003c/code\u003e challenge by interpolating a \u003ccode\u003eresource_metadata\u003c/code\u003e URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the \u003ccode\u003eHost\u003c/code\u003e, a path segment, or a header), a tenant containing a \u003ccode\u003e\"\u003c/code\u003e closes the quoted value and appends attacker-chosen auth-params, including a second \u003ccode\u003eresource_metadata\u003c/code\u003e URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the `WWW-Authenticate` challenge header.\n\n`BearerPlug` and `RequireScopePlug` built the `Bearer resource_metadata=\"...\"` challenge by interpolating a `resource_metadata` URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the `Host`, a path segment, or a header), a tenant containing a `\"` closes the quoted value and appends attacker-chosen auth-params, including a second `resource_metadata` URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.\n\nBearerPlug and RequireScopePlug built the Bearer resource_metadata=\"...\" challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a \" closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:30:55.280Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-2h3v-83jg-2qmm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82756.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82756"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/09f97476715da031b136eaec7b2cda2363ad8149"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82756",
"datePublished": "2026-09-07T22:30:55.280Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:33.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82755 (GCVE-0-2026-82755)
Vulnerability from nvd – Published: 2026-09-07 22:28 – Updated: 2026-09-08 14:42
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Summary
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:42 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82755.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82755 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:42:10.746522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:42:17.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the `Host`) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Host) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\u003c/p\u003e\n\u003cp\u003eThe RFC 8414 and RFC 9728 metadata endpoints in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u003c/code\u003e return tenant-specific values (\u003ccode\u003eissuer\u003c/code\u003e, \u003ccode\u003eauthorization_endpoint\u003c/code\u003e, \u003ccode\u003etoken_endpoint\u003c/code\u003e, \u003ccode\u003ejwks_uri\u003c/code\u003e) when a tenant is set, but sent them with \u003ccode\u003eCache-Control: public, max-age=3600\u003c/code\u003e and no \u003ccode\u003eVary\u003c/code\u003e. When the tenant is derived from something other than the URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in `AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter` return tenant-specific values (`issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`) when a tenant is set, but sent them with `Cache-Control: public, max-age=3600` and no `Vary`. When the tenant is derived from something other than the URL (a header or the `Host`) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-204",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:28:24.500Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-crqf-7m54-4hgc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82755.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82755"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82755",
"datePublished": "2026-09-07T22:28:24.500Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:42:17.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82754 (GCVE-0-2026-82754)
Vulnerability from nvd – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:41 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82754.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82754 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < a72972d7ed3eb74c05dfa0653a258ef14454459a
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:41:33.862078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:45.077Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "a72972d7ed3eb74c05dfa0653a258ef14454459a",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the \u003ccode\u003e/oauth\u003c/code\u003e prefix, or allow-listing \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, that the alias then bypasses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the `/oauth` prefix, or allow-listing `/.well-known` as unauthenticated, that the alias then bypasses."
}
],
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the /oauth prefix, or allow-listing /.well-known as unauthenticated, that the alias then bypasses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eoauth2_server_protocol_routes/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.Router\u003c/code\u003e forwards the same \u003ccode\u003eProtocolRouter\u003c/code\u003e at both the \u003ccode\u003e/oauth\u003c/code\u003e prefix and the \u003ccode\u003e/.well-known\u003c/code\u003e prefix. Phoenix \u003ccode\u003eforward\u003c/code\u003e strips the matched prefix before dispatch, so the full route table answers under both mounts, and \u003ccode\u003ePOST /register\u003c/code\u003e, \u003ccode\u003ePOST /token\u003c/code\u003e, and \u003ccode\u003ePOST /revoke\u003c/code\u003e are reachable as \u003ccode\u003e/.well-known/register\u003c/code\u003e, \u003ccode\u003e/.well-known/token\u003c/code\u003e, and \u003ccode\u003e/.well-known/revoke\u003c/code\u003e. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the \u003ccode\u003e/oauth\u003c/code\u003e paths, or that allow-list \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, do not apply to the alias.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\n`oauth2_server_protocol_routes/1` in `AshAuthentication.Phoenix.Oauth2Server.Router` forwards the same `ProtocolRouter` at both the `/oauth` prefix and the `/.well-known` prefix. Phoenix `forward` strips the matched prefix before dispatch, so the full route table answers under both mounts, and `POST /register`, `POST /token`, and `POST /revoke` are reachable as `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the `/oauth` paths, or that allow-list `/.well-known` as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\noauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-554",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-554 Functionality Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424 Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:56.762Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wwxg-h779-3wf4"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82754.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82754"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/a72972d7ed3eb74c05dfa0653a258ef14454459a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82754",
"datePublished": "2026-09-07T22:23:56.762Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:45.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82753 (GCVE-0-2026-82753)
Vulnerability from nvd – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:39
VLAI
EPSS
VEX
Title
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.
The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:39 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82753.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82753 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 45e24f69e0f95d67413e2508acc2264156acb5ac
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:39:20.932056Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:39:54.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "45e24f69e0f95d67413e2508acc2264156acb5ac",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the client resource has Client ID Metadata Documents enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e) and the authorize endpoint is exposed. CIMD is off by default.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (`cimd_enabled?: true`) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (cimd_enabled?: true) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e/authorize\u003c/code\u003e endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, \u003ccode\u003eresolve_client/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD\u003c/code\u003e fetches the document for each new URL-shaped \u003ccode\u003eclient_id\u003c/code\u003e and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in \u003ccode\u003eCIMD.Cache\u003c/code\u003e before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe `/authorize` endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, `resolve_client/3` in `AshAuthentication.Oauth2Server.CIMD` fetches the document for each new URL-shaped `client_id` and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in `CIMD.Cache` before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:08.176Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-9pv3-wxjm-f846"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82753.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82753"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/45e24f69e0f95d67413e2508acc2264156acb5ac"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82753",
"datePublished": "2026-09-07T22:23:08.176Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:39:54.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82758 (GCVE-0-2026-82758)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:32 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Summary
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82758.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82758 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < 30a87101871775d27d79f9ad6f29eafa4779e118
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:40:53.437993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:06.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "30a87101871775d27d79f9ad6f29eafa4779e118",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the server configures an \u003ccode\u003einitial_access_token\u003c/code\u003e (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (\u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e) or an \u003ccode\u003e{:error, _}\u003c/code\u003e for it, rather than a non-empty binary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the server configures an `initial_access_token` (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (`nil`, `false`, or `\"\"`) or an `{:error, _}` for it, rather than a non-empty binary."
}
],
"value": "Reachable only when the server configures an initial_access_token (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (nil, false, or \"\") or an {:error, _} for it, rather than a non-empty binary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_secret/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server\u003c/code\u003e (reached through \u003ccode\u003e__resolve_secret__!\u003c/code\u003e) treated any return other than \u003ccode\u003e{:ok, _}\u003c/code\u003e or \u003ccode\u003e:error\u003c/code\u003e from a configured \u003ccode\u003e{module, function, args}\u003c/code\u003e or 2-arity-function secret provider as a valid secret, wrapping \u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e as \u003ccode\u003e{:ok, value}\u003c/code\u003e. When the \u003ccode\u003einitial_access_token\u003c/code\u003e resolves to such an empty value, \u003ccode\u003ePOST /oauth/register\u003c/code\u003e compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as \u003ccode\u003esigning_secret\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\n`resolve_secret/3` in `AshAuthentication.Oauth2Server` (reached through `__resolve_secret__!`) treated any return other than `{:ok, _}` or `:error` from a configured `{module, function, args}` or 2-arity-function secret provider as a valid secret, wrapping `nil`, `false`, or `\"\"` as `{:ok, value}`. When the `initial_access_token` resolves to such an empty value, `POST /oauth/register` compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as `signing_secret`.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\nresolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or \"\" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:32:17.027Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82758",
"datePublished": "2026-09-07T22:32:17.027Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:06.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82757 (GCVE-0-2026-82757)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:31 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82757 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 268b591261a3473ab9b87272963e4dd2fd99d972
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:50.818031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:57.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "268b591261a3473ab9b87272963e4dd2fd99d972",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when Client ID Metadata Documents are enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when Client ID Metadata Documents are enabled (`cimd_enabled?: true`), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"value": "Reachable only when Client ID Metadata Documents are enabled (cimd_enabled?: true), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003epublic_ip?/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD.ReqFetcher\u003c/code\u003e enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible \u003ccode\u003e::/96\u003c/code\u003e (for example \u003ccode\u003e::127.0.0.1\u003c/code\u003e), SIIT IPv4-translated \u003ccode\u003e::ffff:0:0:0/96\u003c/code\u003e, and deprecated site-local \u003ccode\u003efec0::/10\u003c/code\u003e. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\n`public_ip?/1` in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible `::/96` (for example `::127.0.0.1`), SIIT IPv4-translated `::ffff:0:0:0/96`, and deprecated site-local `fec0::/10`. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\npublic_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:31:34.656Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wprp-8gvj-p6cv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/268b591261a3473ab9b87272963e4dd2fd99d972"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82757",
"datePublished": "2026-09-07T22:31:34.656Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:57.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82756 (GCVE-0-2026-82756)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:30 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.
BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82756.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82756 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 09f97476715da031b136eaec7b2cda2363ad8149
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:23.093058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:33.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "09f97476715da031b136eaec7b2cda2363ad8149",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, \u003ccode\u003eHost\u003c/code\u003e, path, or header) and uses \u003ccode\u003eBearerPlug\u003c/code\u003e or \u003ccode\u003eRequireScopePlug\u003c/code\u003e; the tenant reaches the challenge through the server\u0027s tenant-aware \u003ccode\u003eresource_url\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, `Host`, path, or header) and uses `BearerPlug` or `RequireScopePlug`; the tenant reaches the challenge through the server\u0027s tenant-aware `resource_url`."
}
],
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Host, path, or header) and uses BearerPlug or RequireScopePlug; the tenant reaches the challenge through the server\u0027s tenant-aware resource_url."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the \u003ccode\u003eWWW-Authenticate\u003c/code\u003e challenge header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBearerPlug\u003c/code\u003e and \u003ccode\u003eRequireScopePlug\u003c/code\u003e built the \u003ccode\u003eBearer resource_metadata=\"...\"\u003c/code\u003e challenge by interpolating a \u003ccode\u003eresource_metadata\u003c/code\u003e URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the \u003ccode\u003eHost\u003c/code\u003e, a path segment, or a header), a tenant containing a \u003ccode\u003e\"\u003c/code\u003e closes the quoted value and appends attacker-chosen auth-params, including a second \u003ccode\u003eresource_metadata\u003c/code\u003e URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the `WWW-Authenticate` challenge header.\n\n`BearerPlug` and `RequireScopePlug` built the `Bearer resource_metadata=\"...\"` challenge by interpolating a `resource_metadata` URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the `Host`, a path segment, or a header), a tenant containing a `\"` closes the quoted value and appends attacker-chosen auth-params, including a second `resource_metadata` URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.\n\nBearerPlug and RequireScopePlug built the Bearer resource_metadata=\"...\" challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a \" closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:30:55.280Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-2h3v-83jg-2qmm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82756.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82756"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/09f97476715da031b136eaec7b2cda2363ad8149"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82756",
"datePublished": "2026-09-07T22:30:55.280Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:33.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82755 (GCVE-0-2026-82755)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:28 – Updated: 2026-09-08 14:42
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Summary
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:42 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82755.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82755 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:42:10.746522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:42:17.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the `Host`) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Host) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\u003c/p\u003e\n\u003cp\u003eThe RFC 8414 and RFC 9728 metadata endpoints in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u003c/code\u003e return tenant-specific values (\u003ccode\u003eissuer\u003c/code\u003e, \u003ccode\u003eauthorization_endpoint\u003c/code\u003e, \u003ccode\u003etoken_endpoint\u003c/code\u003e, \u003ccode\u003ejwks_uri\u003c/code\u003e) when a tenant is set, but sent them with \u003ccode\u003eCache-Control: public, max-age=3600\u003c/code\u003e and no \u003ccode\u003eVary\u003c/code\u003e. When the tenant is derived from something other than the URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in `AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter` return tenant-specific values (`issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`) when a tenant is set, but sent them with `Cache-Control: public, max-age=3600` and no `Vary`. When the tenant is derived from something other than the URL (a header or the `Host`) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-204",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:28:24.500Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-crqf-7m54-4hgc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82755.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82755"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82755",
"datePublished": "2026-09-07T22:28:24.500Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:42:17.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82754 (GCVE-0-2026-82754)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:41 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82754.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82754 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < a72972d7ed3eb74c05dfa0653a258ef14454459a
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:41:33.862078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:45.077Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "a72972d7ed3eb74c05dfa0653a258ef14454459a",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the \u003ccode\u003e/oauth\u003c/code\u003e prefix, or allow-listing \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, that the alias then bypasses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the `/oauth` prefix, or allow-listing `/.well-known` as unauthenticated, that the alias then bypasses."
}
],
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the /oauth prefix, or allow-listing /.well-known as unauthenticated, that the alias then bypasses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eoauth2_server_protocol_routes/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.Router\u003c/code\u003e forwards the same \u003ccode\u003eProtocolRouter\u003c/code\u003e at both the \u003ccode\u003e/oauth\u003c/code\u003e prefix and the \u003ccode\u003e/.well-known\u003c/code\u003e prefix. Phoenix \u003ccode\u003eforward\u003c/code\u003e strips the matched prefix before dispatch, so the full route table answers under both mounts, and \u003ccode\u003ePOST /register\u003c/code\u003e, \u003ccode\u003ePOST /token\u003c/code\u003e, and \u003ccode\u003ePOST /revoke\u003c/code\u003e are reachable as \u003ccode\u003e/.well-known/register\u003c/code\u003e, \u003ccode\u003e/.well-known/token\u003c/code\u003e, and \u003ccode\u003e/.well-known/revoke\u003c/code\u003e. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the \u003ccode\u003e/oauth\u003c/code\u003e paths, or that allow-list \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, do not apply to the alias.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\n`oauth2_server_protocol_routes/1` in `AshAuthentication.Phoenix.Oauth2Server.Router` forwards the same `ProtocolRouter` at both the `/oauth` prefix and the `/.well-known` prefix. Phoenix `forward` strips the matched prefix before dispatch, so the full route table answers under both mounts, and `POST /register`, `POST /token`, and `POST /revoke` are reachable as `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the `/oauth` paths, or that allow-list `/.well-known` as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\noauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-554",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-554 Functionality Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424 Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:56.762Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wwxg-h779-3wf4"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82754.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82754"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/a72972d7ed3eb74c05dfa0653a258ef14454459a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82754",
"datePublished": "2026-09-07T22:23:56.762Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:45.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82753 (GCVE-0-2026-82753)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:39
VLAI
EPSS
VEX
Title
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.
The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:39 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82753.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82753 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 45e24f69e0f95d67413e2508acc2264156acb5ac
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:39:20.932056Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:39:54.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "45e24f69e0f95d67413e2508acc2264156acb5ac",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the client resource has Client ID Metadata Documents enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e) and the authorize endpoint is exposed. CIMD is off by default.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (`cimd_enabled?: true`) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (cimd_enabled?: true) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e/authorize\u003c/code\u003e endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, \u003ccode\u003eresolve_client/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD\u003c/code\u003e fetches the document for each new URL-shaped \u003ccode\u003eclient_id\u003c/code\u003e and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in \u003ccode\u003eCIMD.Cache\u003c/code\u003e before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe `/authorize` endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, `resolve_client/3` in `AshAuthentication.Oauth2Server.CIMD` fetches the document for each new URL-shaped `client_id` and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in `CIMD.Cache` before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:08.176Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-9pv3-wxjm-f846"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82753.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82753"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/45e24f69e0f95d67413e2508acc2264156acb5ac"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82753",
"datePublished": "2026-09-07T22:23:08.176Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:39:54.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}