Read the docs
TI-2026-57073 Aliases CVE-2026-82755

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly…

Priority LOW 29CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys. This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00658 51st percentileScored 2026-11-07
Fix Fixed ash_authentication_oauth2_server (ash-project): 0.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ash-projectash_authentication_oauth2_server0.1.3 to before 0.3.10.3.1Patch availableCNA
  • ash_authentication_oauth2_server Vendorash-project Affected 0.1.3 to before 0.3.1 Fixed in 0.3.1 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_authentication_oauth2_server (ash-project) Fixed in 0.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ash-project ash_authentication_oauth2_server 0.3.1

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-57071 Resource allocation without limits in ash-project ash_authentication_oauth2_serverPriority LOW 37
    • TI-2026-57076 Improper authentication in ash-project ash_authentication_oauth2_serverPriority LOW 29
    • TI-2026-57075 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRFPriority LOW 29
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82755
  2. 2026-10-09 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 1

Other 2

  • TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
  • TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
  • TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
  • TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
  • TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences