ash-project ash_authentication_oauth2_server up to 0.3.0 encoding error

Summaryinfo

A vulnerability marked as critical has been reported in ash-project ash_authentication_oauth2_server up to 0.3.0. This impacts an unknown function. The manipulation leads to encoding error. This vulnerability is listed as CVE-2026-82756. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ash-project ash_authentication_oauth2_server up to 0.3.0. This issue affects an unknown code. The manipulation with an unknown input leads to a encoding error vulnerability. Using CWE to declare the problem leads to CWE-172. The product does not properly encode or decode the data, resulting in unexpected values. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting. This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-82756 since 08/31/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.3.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_authentication_oauth2_server

Version

• 0.1
• 0.2
• 0.3.0

Website

• Product: https://github.com/ash-project/ash_authentication_oauth2_server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion