CVE-2026-82755 ash-project CVE debrief

Who should care

Defenders responsible for ash_authentication_oauth2_server deployments, especially those using shared HTTP caches, should assess exposure and verify remediation. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review cache configurations, tenant isolation, and OAuth metadata handling to prevent potential misuse of authorization codes and secrets.

Why it matters

CVE-2026-82755 is a medium-severity vulnerability in ash_authentication_oauth2_server that can lead to sensitive information disclosure across tenants due to improper cache handling. Defenders should verify and remediate this issue, especially in shared cache environments, and monitor for potential misuse.

• Potential disclosure of tenant-specific OAuth metadata
• Possible misuse of authorization codes and secrets by affected clients
• Validation of tokens against incorrect keys
• Verification of cache configurations and tenant isolation

Technical summary

The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values but are sent with Cache-Control: public, max-age=3600 and no Vary header. This allows a shared cache to serve one tenant's OAuth discovery metadata to another tenant's clients for up to an hour, potentially leading to sensitive information disclosure. Affected clients may send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys. Defenders should prioritize verifying and remediating this vulnerability in ash_authentication_oauth2_server versions from 0.1.3 before 0.3.1.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in ash_authentication_oauth2_server versions from 0.1.3 before 0.3.1.

Recommended defensive actions

• Verify the version of ash_authentication_oauth2_server and upgrade to 0.3.1 or later if necessary.
• Review and adjust cache configurations to prevent serving sensitive information across tenants.
• Monitor for potential misuse of authorization codes and secrets.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source references provide details on the Use of Cache Containing Sensitive Information vulnerability in ash_authentication_oauth2_server. The NVD entry is currently 6.3 (MEDIUM). Evidence is limited to CVE and NVD entries. Defenders should verify cache configurations, tenant isolation, and OAuth metadata handling. Limited source detail exists; explicit evidence limits apply.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.