CVE-2026-82755

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82755
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82755.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82755
Aliases
Published
2026-09-07T22:28:24Z
Modified
2026-09-10T03:30:27Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Details

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.

The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.

This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-524"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82755.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "99de0a1cacb5ef667c4533278b7c81ca98c00231"
                },
                {
                    "fixed": "768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/ash-project/ash_authentication_oauth2_server

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_authentication_oauth2_server
Events
Introduced
34ecef8343573572a10fd1587d40032be54df05b
Fixed
15bde4311e31c925a428f34c02b283307619e2a2
Fixed
768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.3"
        },
        {
            "fixed": "0.3.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.3
v0.2.0
v0.2.1
v0.2.2
v0.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82755.json"