CVE-2026-82755: CWE-524 Use of Cache Containing Sensitive Information in ash-project ash_authentication_oauth2_server
CVE-2026-82755 is a vulnerability in ash-project's ash_authentication_oauth2_server where sensitive OAuth discovery metadata is cached publicly and shared across tenants. This allows one tenant's metadata to be served to another tenant's clients due to improper cache control headers and lack of cache key variation. The issue affects versions from 0.1.3 up to but not including 0.3.1.
AI Analysis
Technical Summary
The vulnerability arises because the RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific OAuth metadata with HTTP headers 'Cache-Control: public, max-age=3600' and no 'Vary' header. When tenant identification is based on headers or Host rather than the URL, a shared HTTP cache keyed only by URL can serve cached metadata from one tenant to another for up to one hour. This can cause clients to send authorization codes and secrets to incorrect tenant token endpoints and validate tokens against wrong keys, potentially undermining tenant isolation.
Potential Impact
Sensitive OAuth metadata intended for one tenant can be leaked to other tenants sharing the same cache, leading to cross-tenant information disclosure. This may cause clients to interact with incorrect tenant endpoints, risking authorization code and secret misdirection and token validation errors. The impact is limited to the exposure of metadata and potential misrouting of OAuth flows, with no direct code execution or privilege escalation reported.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should monitor the vendor advisory for updates. As a temporary mitigation, avoid using shared HTTP caches in front of the affected endpoints or configure caches to respect tenant-specific headers by including appropriate 'Vary' headers to prevent cross-tenant cache sharing.
CVE-2026-82755: CWE-524 Use of Cache Containing Sensitive Information in ash-project ash_authentication_oauth2_server
Description
CVE-2026-82755 is a vulnerability in ash-project's ash_authentication_oauth2_server where sensitive OAuth discovery metadata is cached publicly and shared across tenants. This allows one tenant's metadata to be served to another tenant's clients due to improper cache control headers and lack of cache key variation. The issue affects versions from 0.1.3 up to but not including 0.3.1.
CVSS v4.0
Score 6.3medium
Affected software
pkg:hex/ash_authentication_oauth2_serverpkg:github/ash-project/ash_authentication_oauth2_servercpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because the RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific OAuth metadata with HTTP headers 'Cache-Control: public, max-age=3600' and no 'Vary' header. When tenant identification is based on headers or Host rather than the URL, a shared HTTP cache keyed only by URL can serve cached metadata from one tenant to another for up to one hour. This can cause clients to send authorization codes and secrets to incorrect tenant token endpoints and validate tokens against wrong keys, potentially undermining tenant isolation.
Potential Impact
Sensitive OAuth metadata intended for one tenant can be leaked to other tenants sharing the same cache, leading to cross-tenant information disclosure. This may cause clients to interact with incorrect tenant endpoints, risking authorization code and secret misdirection and token validation errors. The impact is limited to the exposure of metadata and potential misrouting of OAuth flows, with no direct code execution or privilege escalation reported.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should monitor the vendor advisory for updates. As a temporary mitigation, avoid using shared HTTP caches in front of the affected endpoints or configure caches to respect tenant-specific headers by including appropriate 'Vary' headers to prevent cross-tenant cache sharing.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-31T01:00:10.817Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a9f3cc3acd9273b496d74c3
Added to database: 09/07/2026, 22:37:55 UTC
Last enriched: 09/07/2026, 22:52:52 UTC
Last updated: 09/08/2026, 00:16:38 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.