CVE-2026-82757
MediumCVSS 6.3Summary
SSRF vulnerability in ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. The public_ip?/1 function incorrectly classifies certain address ranges as public, allowing policy bypass.
Risk Assessment
An attacker can use the server to scan internal networks, access internal services, and potentially exfiltrate data.
Recommendation
Upgrade ash_authentication_oauth2_server to version 0.3.1 or later, which includes a fix in the public_ip?/1 function.
Other vulnerabilities in ash_authentication_oauth2_server
See all- CVE-2026-82758Medium
Vulnerability in ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. The resolve_secret/3 function treats any return other than {:ok, _} or :error as a valid secret, allowing bypass of protections.
- CVE-2026-82756Medium
Vulnerability in ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. The resource_metadata value is interpolated without proper escaping, allowing header modification and redirecting clients to a malicious authorization server.
- CVE-2026-82755Medium
Vulnerability in ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. Responses with metadata are marked as Cache-Control: public without a Vary header, causing responses to be cached and served to other tenants.
- CVE-2026-82754Medium
Vulnerability in ash_authentication_oauth2_server exposes state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. Routes are mounted under both /oauth and /.well-known, allowing access to /register, /token, and /revoke via alternative paths.
- CVE-2026-82753High
Resource exhaustion vulnerability in ash_authentication_oauth2_server. An unauthenticated attacker can exhaust database storage and memory by sending requests to the /authorize endpoint with many distinct client_id URLs, creating permanent client rows and caching documents without limits.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.