The SSRF vulnerability in ash_authentication_oauth2_server stems from improper classification of IPv6 addresses in the public_ip?/1 function within AshAuthentication.Oauth2Server.CIMD.ReqFetcher. Specifically, IPv4-compatible (::/96), SIIT IPv4-translated (::ffff:0:0:0/96), and deprecated site-local (fec0::/10) IPv6 ranges were incorrectly treated as publicly routable. This flaw allowed an attacker controlling the client metadata URL and DNS to bypass outbound request policies and make the server connect to internal or loopback addresses, potentially exposing internal services. The issue affects versions from 0.3.0 before 0.3.1.

An attacker with control over the client metadata URL and its DNS can exploit this vulnerability to make the server initiate connections to internal or loopback network addresses that should have been blocked. This could lead to unauthorized access or interaction with internal network resources that are normally inaccessible from outside, potentially exposing sensitive information or enabling further attacks within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Until a patch is available, users should consider restricting or validating client metadata URLs and DNS controls to trusted sources to mitigate risk.