CVE-2026-82758: CWE-287 Improper Authentication in ash-project ash_authentication_oauth2_server

The vulnerability in ash_authentication_oauth2_server stems from the resolve_secret/3 function in AshAuthentication.Oauth2Server, which incorrectly treats any return value other than {:ok, _} or :error from a secret provider as a valid secret. This includes nil, false, or empty strings wrapped as {:ok, value}. When the initial_access_token resolves to such an empty value, the POST /oauth/register endpoint compares the presented bearer token against it, and the comparison passes even if no token is supplied. This fail-open behavior allows unauthenticated attackers to register OAuth clients despite configuration intended to restrict registration. Other secrets resolved similarly, such as signing_secret, are also affected. The vulnerability affects versions >=0.1.0 and <0.3.1 of ash_authentication_oauth2_server.

An unauthenticated attacker can bypass authentication controls intended to restrict OAuth client registration, potentially allowing unauthorized client registrations. This could undermine the security of OAuth flows relying on dynamic client registration restrictions. No known exploits in the wild have been reported. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality and integrity.

No official patch or fix link is provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling dynamic client registration or implementing additional access controls to prevent unauthorized registrations. Monitor vendor communications for updates and apply official patches once released.