CVE-2026-82753

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82753

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82753.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82753

Aliases

EEF-CVE-2026-82753
GHSA-9pv3-wxjm-f846

Published

2026-09-07T22:23:08Z

Modified

2026-09-10T03:30:53Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Details

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.

The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.

This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.

Database specific

{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82753.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "e713a9ba816761140c226e2ca55b75c0b93f5984"
                },
                {
                    "fixed": "45e24f69e0f95d67413e2508acc2264156acb5ac"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/ash-project/ash_authentication_oauth2_server

Affected ranges

Type

GIT

Repo

https://github.com/ash-project/ash_authentication_oauth2_server

Events

Introduced

2681877faf2ef0df7d95852c2a72e9e972c64b7e

Fixed

15bde4311e31c925a428f34c02b283307619e2a2

Fixed

45e24f69e0f95d67413e2508acc2264156acb5ac

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.3.0"
        },
        {
            "fixed": "0.3.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82753.json"