EEF-CVE-2026-82757

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-82757.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-82757.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-82757
Aliases
  • GHSA-wprp-8gvj-p6cv
  • CVE-2026-82757
Published
2026-09-07T22:31:34Z
Modified
2026-09-07T22:45:02Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Details

Summary

Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.

public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.

This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.

Configuration

Reachable only when Client ID Metadata Documents are enabled (cimd_enabled?: true), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms.

Database specific 
{
    "capec_ids": [
        "CAPEC-664"
    ],
    "cpe_ids": [
        "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-918"
    ]
}
References
Credits
    • Peter Ullrich - FINDER
    • Peter Ullrich - REPORTER
    • Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
    • Jonatan Männchen / EEF - COORDINATOR

Affected packages

Hex / ash_authentication_oauth2_server

Package

Name
ash_authentication_oauth2_server
Purl
pkg:hex/ash_authentication_oauth2_server

Affected ranges

Type
SEMVER
Events
Introduced
0.3.0
Fixed
0.3.1

Affected versions

0.*
0.3.0

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-82757.json"

Git / github.com/ash-project/ash_authentication_oauth2_server

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_authentication_oauth2_server
Events
Introduced
e713a9ba816761140c226e2ca55b75c0b93f5984
Fixed
268b591261a3473ab9b87272963e4dd2fd99d972

Affected versions

v0.*
v0.3.0

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-82757.json"