Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82758— ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Quick assessment

Affected
ash-project ash_authentication_oauth2_server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ash-project 的 ash_authentication_oauth2_server 中存在一个身份验证不当漏洞，使得未经身份验证的攻击者可以在动态客户端注册被初始访问令牌（initial access token）控制（gated）的情况下，仍然能够注册 OAuth 客户端。 问题根源在于 AshAuthentication.Oauth2Server 中的 resolve_secret/3 函数（通过 调用）。该函数将配置的 或二元函数形式秘钥提供者返回的任何非 且非 的结果（例如 、 或 ）都视为有效秘

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82758

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_authentication_oauth2_server 0.1.0 ~ 0.3.1 cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*
ash-project ash_authentication_oauth2_server 855b578037c5ded18e8a6e60f42e56bde4905fae ~ 30a87101871775d27d79f9ad6f29eafa4779e118 cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82758

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82758

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82758 (1)

Vendor Advisories for CVE-2026-82758 (1)

Vendor Pages for CVE-2026-82758 (1)

Other References for CVE-2026-82758 (1)

Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total

CVE-2026-82753 8.2 HIGH Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and c
CVE-2026-82586 8.2 HIGH AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private at
CVE-2026-82755 6.3 MEDIUM ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheab
CVE-2026-82754 6.3 MEDIUM ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypas
CVE-2026-82757 6.3 MEDIUM ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addre
CVE-2026-82756 6.3 MEDIUM ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenti
CVE-2026-82584 2.3 LOW Terminal escape sequence injection in the mix igniter.install confirmation prompt via pack
CVE-2026-81638 2.1 LOW Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

IV. Related Vulnerabilities

Same product: ash_authentication_oauth2_server
Same vendor: ash-project
Same weakness: CWE-287

V. Comments for CVE-2026-82758

No comments yet

Leave a comment