CVE-2026-82757: CWE-918 Server-Side Request Forgery (SSRF) in ash-project ash_authentication_oauth2_server

The SSRF vulnerability in ash_authentication_oauth2_server occurs due to improper enforcement of outbound policy in the public_ip?/1 function within AshAuthentication.Oauth2Server.CIMD.ReqFetcher. Specifically, IPv4-compatible (::/96), SIIT IPv4-translated (::ffff:0:0:0/96), and deprecated site-local (fec0::/10) IPv6 address ranges were mistakenly treated as publicly routable. Consequently, an attacker who controls the client metadata URL and its DNS can cause the server to fetch resources from internal or loopback addresses, bypassing intended network restrictions. This affects versions >=0.3.0 and <0.3.1.

An attacker able to control the client metadata URL and DNS can exploit this SSRF vulnerability to make the server initiate connections to internal or loopback network addresses that should be blocked. This could lead to unauthorized access to internal services or sensitive information accessible only within the server's network environment. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attack requirement, and limited scope impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated in the provided data, users should monitor the vendor's announcements for updates. Until a fix is available, restrict or validate client metadata URLs and DNS responses to prevent attacker-controlled inputs that could exploit this SSRF vulnerability.