The vulnerability in ash_authentication_oauth2_server (versions >=0.3.0 <0.3.1) involves allocation of resources without limits or throttling (CWE-770). The /authorize endpoint, which is unauthenticated by design, triggers resolve_client/3 in AshAuthentication.Oauth2Server.CIMD to fetch and upsert client metadata documents for each new URL-shaped client_id. There is no cap on the number of client rows created, no expiry or garbage collection, and no length limit on the fetched fields. Additionally, documents are cached before validation, causing memory to be held even for rejected documents until TTL expiration. An attacker can exploit this by serving valid documents at many distinct URLs, creating many permanent client rows with multi-megabyte strings, leading to unbounded growth in storage and memory consumption.

An unauthenticated attacker can cause denial of service by exhausting database storage and server memory resources. This can degrade or disrupt service availability due to uncontrolled growth of client rows and cached documents. There is no indication of direct code execution or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the available data. Until a patch is available, monitoring and limiting the number of client_id metadata documents or disabling Client ID Metadata Documents feature may be considered if feasible, but these are not confirmed mitigations from the vendor.