CVE-2026-82754: CWE-424 Improper Protection of Alternate Path in ash-project ash_authentication_oauth2_server

The vulnerability arises because the oauth2_server_protocol_routes/1 function in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth and /.well-known prefixes. Phoenix framework strips the matched prefix before dispatching, causing the full route table to be accessible under both prefixes. Consequently, state-changing OAuth endpoints like POST /register, POST /token, and POST /revoke are reachable via /.well-known/register, /.well-known/token, and /.well-known/revoke. Security controls applied only to the /oauth prefix do not apply to these alternate paths, potentially allowing unauthorized or unintended access.

Attackers can bypass security controls such as web application firewall rules, rate limiting, or authentication exemptions that are applied only to the /oauth prefix by accessing the OAuth endpoints through the /.well-known prefix. This could lead to unauthorized state changes in the OAuth server, potentially impacting authentication flows. The CVSS 4.0 base score is 6.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, security controls should be reviewed and extended to cover the /.well-known prefix to prevent bypass. Specifically, WAF rules, rate limits, and authentication exemptions should be applied consistently to both /oauth and /.well-known paths to ensure proper protection of OAuth endpoints.