The vulnerability in ash_authentication_oauth2_server (CVE-2026-82758) stems from the resolve_secret/3 function in AshAuthentication.Oauth2Server, which incorrectly treats any return value other than {:ok, _} or :error from a configured secret provider as a valid secret. This includes nil, false, or empty string values wrapped as {:ok, value}. When the initial_access_token resolves to such an empty value, the POST /oauth/register endpoint compares the presented bearer token against it, allowing the comparison to succeed even with no token supplied. Consequently, OAuth client registration is improperly open despite configuration to restrict it. The same fail-open logic affects other secrets such as signing_secret. This issue impacts versions 0.1.0 through before 0.3.1 of ash_authentication_oauth2_server.

An unauthenticated attacker can bypass intended access controls on OAuth client registration, potentially allowing unauthorized client registrations. This undermines the security model that relies on gating Dynamic Client Registration with an initial access token. The vulnerability does not require user interaction and can be exploited remotely. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is documented in the provided data. Until a fix is available, users should consider disabling Dynamic Client Registration or implementing additional access controls to mitigate unauthorized client registrations.