ash-project ash_authentication_oauth2_server up to 0.3.0 Secret Resolution resolve_secret improper authentication

Summaryinfo

A vulnerability described as problematic has been identified in ash-project ash_authentication_oauth2_server up to 0.3.0. Affected is the function resolve_secret of the component Secret Resolution. The manipulation results in improper authentication. This vulnerability is cataloged as CVE-2026-82758. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ash-project ash_authentication_oauth2_server up to 0.3.0. Affected is the function resolve_secret of the component Secret Resolution. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on integrity. CVE summarizes:

Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-82758 since 08/31/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 0.3.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_authentication_oauth2_server

Version

• 0.1
• 0.2
• 0.3.0

Website

• Product: https://github.com/ash-project/ash_authentication_oauth2_server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion