Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-82753— Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Quick assessment

Affected

ash-project ash_authentication_oauth2_server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ash-project 的 ash_authentication_oauth2_server 中存在“资源分配无限制或无节流（Allocation of Resources Without Limits or Throttling）”漏洞，允许未经身份验证的攻击者耗尽数据库存储和内存。端点在设计上无需身份验证。当启用“客户端 ID 元数据文档（Client ID Metadata Documents，即 CIMD）时，中的函数会为每个新的 URL 格式的获取对应的元数据文档，并执行 upsert 操作创建一

CVSS 8.2 · High Updated Sep 08, 2026

Possible ATT&CK Techniques 1 AI

T1230

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ash-project	ash_authentication_oauth2_server	0.3.0 ~ 0.3.1	`cpe:2.3:a:ash-project:ash_authentication_oauth2_server::::::::`
ash-project	ash_authentication_oauth2_server	e713a9ba816761140c226e2ca55b75c0b93f5984 ~ 45e24f69e0f95d67413e2508acc2264156acb5ac	`cpe:2.3:a:ash-project:ash_authentication_oauth2_server::::::::`

II. Public POCs for CVE-2026-82753

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-82753

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-82753 (3)

🔗 Unauthenticated resource exhaustion via unbounded CIMD client rows and cache in ash_authentication_oauth2_server · Advisory · ash-project/ash_authentication_oauth2_server · GitHub vendor-advisory related
🔗 CVE-2026-82753 Read full article related
🔗 EEF-CVE-2026-82753 - OSV related

https://www.cve.org/CVERecord?id=CVE-2026-82753

Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total

CVE-2026-82586	8.2 HIGH	AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private at
CVE-2026-82755	6.3 MEDIUM	ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheab
CVE-2026-82758	6.3 MEDIUM	ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gat
CVE-2026-82754	6.3 MEDIUM	ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypas
CVE-2026-82757	6.3 MEDIUM	ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addre
CVE-2026-82756	6.3 MEDIUM	ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenti
CVE-2026-82584	2.3 LOW	Terminal escape sequence injection in the mix igniter.install confirmation prompt via pack
CVE-2026-81638	2.1 LOW	Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

IV. Related Vulnerabilities

Same product: ash_authentication_oauth2_server

Same vendor: ash-project

Same weakness: CWE-770

V. Comments for CVE-2026-82753

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-82753— Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-82753

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-82753

III. Intelligence Information for CVE-2026-82753

Vendor Advisories for CVE-2026-82753 (3)

Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-82753

Leave a comment