CVE-2026-82754

Received Received - Intake

Improper Path Handling in AshAuthentication OAuth2 Server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82754

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_authentication_oauth2_server	From 0.1.0 (inc) to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-424	The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves an improper protection of alternate paths in the ash_authentication_oauth2_server component. The OAuth endpoints intended to be accessible only under the /oauth prefix are mistakenly exposed under the /.well-known prefix as well. This allows attackers to bypass security controls like WAF rules or rate limits that are applied to the /oauth paths.

Detection Guidance

Check if POST requests to /.well-known/register, /.well-known/token, or /.well-known/revoke return valid responses. Use curl commands like curl -X POST http://<target>/.well-known/register to test for unintended endpoint exposure.

Impact Analysis

This vulnerability could allow unauthorized access to OAuth endpoints such as /register, /token, and /revoke via the /.well-known prefix. Attackers might exploit this to perform actions like registering new accounts, obtaining tokens, or revoking tokens without proper authentication or rate limiting.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by exposing OAuth endpoints under unintended URL prefixes. Controls like WAF rules or rate limits scoped to /oauth paths may not apply to /.well-known aliases, potentially allowing unauthorized access to state-changing endpoints such as /register, /token, and /revoke. This could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in these regulations.

Mitigation Strategies

Upgrade ash_authentication_oauth2_server to version 0.3.1 or later. Review and update WAF rules, rate limits, or authentication exemptions to cover both /oauth and /.well-known paths.

Hi! I’m here to help you understand CVE-2026-82754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70