CVE-2026-82753: CWE-770 Allocation of Resources Without Limits or Throttling in ash-project ash_authentication_oauth2_server

The vulnerability arises from the ash_authentication_oauth2_server's handling of client ID Metadata Documents (CIMD). The /authorize endpoint, which is unauthenticated by design, calls resolve_client/3 in AshAuthentication.Oauth2Server.CIMD for each new URL-shaped client_id. This function fetches the metadata document and upserts a client row without any limit on the number of rows, no expiry or garbage collection, and no length restrictions on fetched fields. Additionally, documents are cached before validation, so even invalid documents consume cache memory until their TTL expires. An attacker can exploit this by serving valid documents at many distinct URLs, creating permanent client rows with potentially multi-megabyte strings, leading to exhaustion of database storage and memory.

An unauthenticated attacker can cause denial of service by exhausting database storage and memory resources on the affected server. This can degrade service availability or cause crashes due to resource depletion. There is no indication of direct data compromise or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions >=0.3.0 and <0.3.1, upgrading to version 0.3.1 or later (once available) is expected to address the issue. Until a patch is available, consider implementing rate limiting or other controls on the /authorize endpoint to limit the number of client registrations and the size of client metadata documents.