CVE-2026-82755— ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Quick assessment
Affected
ash-project ash_authentication_oauth2_server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ash-project 的 ash_authentication_oauth2_server 中存在一个“包含敏感信息的缓存使用”漏洞，使得共享 HTTP 缓存可能将一个租户的 OAuth 发现元数据返回给另一个租户的客户端。 在 AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter 中，遵循 RFC 8414 和 RFC 9728 的元数据端点在设置了租户时，会返回租户特定的值（如 issuer、authorization_endpoint、token_end
Possible ATT&CK Techniques 1 AI
T1019
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82755
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Source: CVE Program / CVE List V5
Vulnerability Description
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过缓存导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_authentication_oauth2_server | 0.1.3 ~ 0.3.1 |
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_authentication_oauth2_server | 99de0a1cacb5ef667c4533278b7c81ca98c00231 ~ 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1 |
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82755
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82755
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82755 (1)
Vendor Advisories for CVE-2026-82755 (3)
Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total
| CVE-2026-82753 | 8.2 HIGH | Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and c |
| CVE-2026-82586 | 8.2 HIGH | AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private at |
| CVE-2026-82758 | 6.3 MEDIUM | ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gat |
| CVE-2026-82754 | 6.3 MEDIUM | ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypas |
| CVE-2026-82757 | 6.3 MEDIUM | ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addre |
| CVE-2026-82756 | 6.3 MEDIUM | ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenti |
| CVE-2026-82584 | 2.3 LOW | Terminal escape sequence injection in the mix igniter.install confirmation prompt via pack |
| CVE-2026-81638 | 2.1 LOW | Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry |
IV. Related Vulnerabilities
Same product: ash_authentication_oauth2_server
-
CVE-2026-82758
ash_authentication_oauth2_server treats an empty resolved se -
CVE-2026-82757
ash_authentication_oauth2_server CIMD fetcher classifies IPv -
CVE-2026-82756
ash_authentication_oauth2_server interpolates a tenant-deriv -
CVE-2026-82754
ash_authentication_oauth2_server aliases every protocol endp -
CVE-2026-82753
Unauthenticated authorize requests create unbounded, never-e
Same vendor: ash-project
-
CVE-2026-82710
Terminal escape sequence injection in mix usage_rules.search -
CVE-2026-82584
Terminal escape sequence injection in the mix igniter.instal -
CVE-2026-82586
AshLua read operation aggregate bypasses the exposed-field a -
CVE-2026-81638
Non-canonical ULID spellings are accepted and alias to the s -
CVE-2026-82758
ash_authentication_oauth2_server treats an empty resolved se
Same weakness: CWE-524
-
CVE-2026-15743
Catalyst::Plugin::Static::Simple versions through 0.38 for P -
CVE-2026-59903
Netty: Cache Poisoning and Information Disclosure via CORS V -
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data -
CVE-2026-64648
Next.js: Response Body Cache Confusion for Requests Containi -
CVE-2026-65755
Joomla Extension - regularlabs.com - Date-sensitive query-ca
V. Comments for CVE-2026-82755
No comments yet