CVE-2026-82756: CWE-116 Improper Encoding or Escaping of Output in ash-project ash_authentication_oauth2_server

The vulnerability arises because BearerPlug and RequireScopePlug interpolate a resource_metadata URL derived from the request tenant directly into a quoted value in the WWW-Authenticate challenge header without proper encoding or escaping. In multi-tenant setups where the tenant is set from request-controlled data (such as subdomains or headers), an attacker can craft a tenant value containing a quote character to close the quoted string and inject additional authentication parameters. This injection includes a second resource_metadata URL pointing to an attacker-controlled authorization server, which spec-following clients may trust. The vulnerability does not allow response splitting since carriage returns and line feeds are rejected by Plug. It affects ash_authentication_oauth2_server versions >=0.1.3 and <0.3.1.

An unauthenticated attacker can inject arbitrary authentication parameters into the WWW-Authenticate header, potentially causing clients to follow malicious authorization server URLs. This can lead to authentication bypass or redirection to attacker-controlled servers in multi-tenant applications that use tenant data from untrusted sources. The impact is limited to the authentication challenge header manipulation and does not include response splitting or direct code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, avoid setting the Ash tenant from untrusted request-controlled data or ensure proper encoding and escaping of tenant values before including them in authentication headers.