CVE-2026-82755: CWE-524 Use of Cache Containing Sensitive Information in ash-project ash_authentication_oauth2_server

The vulnerability arises from the use of shared HTTP caching for tenant-specific OAuth discovery metadata endpoints in ash_authentication_oauth2_server. The metadata endpoints return tenant-specific values such as issuer, authorization_endpoint, token_endpoint, and jwks_uri but are sent with Cache-Control: public, max-age=3600, and no Vary header. When tenant identification is derived from headers or the Host rather than the URL, a shared cache uses only the URL as the cache key, causing one tenant's metadata to be served to another tenant's clients for up to an hour. This can cause clients to interact with the wrong tenant's OAuth endpoints, potentially compromising authorization flows.

Clients may send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against incorrect keys, potentially leading to authorization errors or security issues related to token validation. The vulnerability affects multi-tenant deployments where a shared HTTP cache is used and tenant identification is not URL-based. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using shared HTTP caches in front of the affected metadata endpoints or configure cache control headers properly to include tenant-specific cache keys (e.g., using the Vary header). Consider isolating tenant metadata endpoints to prevent cross-tenant caching. Monitor vendor communications for official fixes or updates.