ash-project ash_authentication_oauth2_server up to 0.3.0 Routing Router.ex oauth2_server_protocol_routes missing initialization

Summaryinfo

A vulnerability was found in ash-project ash_authentication_oauth2_server up to 0.3.0. It has been rated as critical. Impacted is the function oauth2_server_protocol_routes of the file AshAuthentication/Phoenix/Oauth2Server/Router.ex of the component Routing. This manipulation causes missing initialization. The identification of this vulnerability is CVE-2026-82754. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ash-project ash_authentication_oauth2_server up to 0.3.0. It has been declared as critical. Affected by this vulnerability is the function oauth2_server_protocol_routes of the file AshAuthentication/Phoenix/Oauth2Server/Router.ex of the component Routing. The manipulation with an unknown input leads to a missing initialization vulnerability. The CWE definition for the vulnerability is CWE-456. The product does not initialize critical variables, which causes the execution environment to use unexpected values. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-82754 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.3.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_authentication_oauth2_server

Version

• 0.1
• 0.2
• 0.3.0

Website

• Product: https://github.com/ash-project/ash_authentication_oauth2_server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion