Threat Intelligence Database

CVE-2026-82758 is an improper authentication vulnerability in ash-project's ash_authentication_oauth2_server. It allows unauthenticated attackers to register OAuth clients even when Dynamic Client Registration is supposed to be restricted by an initial access token. The issue arises because the secret resolution function treats empty or false values as valid secrets, enabling bypass of token checks. This affects versions from 0.1.0 up to but not including 0.3.1.

CVE-2026-82757 is a Server-Side Request Forgery (SSRF) vulnerability in ash-project's ash_authentication_oauth2_server affecting versions from 0.3.0 up to but not including 0.3.1. The vulnerability arises because the server incorrectly classifies certain IPv6 address ranges as publicly routable, allowing an attacker controlling a client metadata URL and its DNS to cause the server to connect to internal or loopback addresses. This could enable unauthorized internal network access via SSRF.

CVE-2026-82756 is an improper encoding or escaping of output vulnerability in ash-project's ash_authentication_oauth2_server. It allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header by manipulating tenant data used in the header construction. This affects versions from 0.1.3 up to but not including 0.3.1. The vulnerability can cause clients to follow attacker-controlled authorization server URLs within the authentication challenge. The CVSS 4.0 score is 6.3, indicating medium severity.

CVE-2026-82755 is a vulnerability in ash-project's ash_authentication_oauth2_server where sensitive OAuth discovery metadata intended for one tenant can be cached and served to another tenant due to improper cache control headers. This occurs because tenant-specific metadata endpoints are sent with Cache-Control: public and no Vary header, causing shared HTTP caches to serve cached responses across tenants. This can lead to clients sending authorization codes and secrets to incorrect token endpoints and validating tokens against wrong keys. The issue affects versions from 0.1.3 up to but not including 0.3.1.

CVE-2026-82754 is an improper protection of alternate path vulnerability in ash-project's ash_authentication_oauth2_server. The OAuth endpoints intended to be accessed under the /oauth prefix are also accessible under the /.well-known prefix due to route forwarding behavior. This allows bypassing security controls such as WAF rules, rate limits, or authentication exemptions that are scoped only to the canonical /oauth prefix. The vulnerability affects versions from 0.1.0 up to but not including 0.3.1.

CVE-2026-82753 is a resource exhaustion vulnerability in ash-project's ash_authentication_oauth2_server affecting versions from 0.3.0 up to but not including 0.3.1. An unauthenticated attacker can exploit the /authorize endpoint to create many client entries with large data fields, causing unbounded growth in database storage and memory usage. This occurs because the system lacks limits, expiry, or garbage collection for client rows created from client ID Metadata Documents, and caches documents before validation, including rejected ones.