CVE-2026-82753

Received Received - Intake

Allocation of Resources Without Limits in ash_authentication_oauth2_server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82753

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_authentication_oauth2_server	From 0.3.0 (inc) to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is an Allocation of Resources Without Limits or Throttling issue in the ash_authentication_oauth2_server component. It allows an unauthenticated attacker to exhaust database storage and memory by exploiting the /authorize endpoint. When Client ID Metadata Documents are enabled, the system fetches and stores documents for each new client_id without limits on rows, expiry, or field length. Attackers can create unlimited client rows with large data, causing unbounded resource consumption.

Detection Guidance

Monitor database storage growth and memory usage for unexpected increases. Check for excessive client rows in the ash_authentication_oauth2_server database, particularly those created via the /authorize endpoint. Look for cache entries in CIMD.Cache holding large documents without proper expiration.

Impact Analysis

This vulnerability can lead to denial of service by consuming all available database storage and memory, causing system crashes or slowdowns. It may also allow attackers to store malicious data in your database, potentially leading to further exploits or data breaches. Systems with high traffic or exposed OAuth2 endpoints are at higher risk.

Compliance Impact

This vulnerability could lead to database storage and memory exhaustion, potentially causing system instability or failure. For GDPR, this may violate principles of data integrity and availability. For HIPAA, it could disrupt access to protected health information, impacting compliance with availability requirements.

Mitigation Strategies

Upgrade ash_authentication_oauth2_server to version 0.3.1 or later. Disable Client ID Metadata Documents if not required. Implement rate limiting on the /authorize endpoint. Set database storage limits and enable garbage collection for client rows. Validate and limit the size of fetched metadata documents before processing.

Hi! I’m here to help you understand CVE-2026-82753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70