CVE-2026-82755

Received Received - Intake

Cache Poisoning in AshAuthentication OAuth2 Server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys. This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82755

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_authentication_oauth2_server	From 0.1.3 (inc) to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability involves a shared HTTP cache serving sensitive OAuth discovery metadata from one tenant to another. The metadata endpoints return tenant-specific values but are cached with a public cache-control header and no vary directive. This allows a shared cache to serve responses for up to an hour, potentially sending authorization codes and secrets to the wrong tenant.

Detection Guidance

To detect this vulnerability, inspect HTTP responses from the OAuth2 server's metadata endpoints (/.well-known/oauth-authorization-server and /.well-known/openid-configuration) for Cache-Control: public headers and missing Vary headers. Check if tenant-specific values like issuer or token_endpoint are returned with a shared cache key. Use curl to fetch these endpoints and verify caching behavior.

Impact Analysis

If you are using ash_authentication_oauth2_server versions between 0.1.3 and 0.3.0, your OAuth tokens and authorization codes could be sent to the wrong tenant's token endpoint. This may lead to unauthorized access, data leakage, or account compromise for affected users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection obligations, and potential legal penalties.

Mitigation Strategies

Upgrade ash_authentication_oauth2_server to version 0.3.1 or later to address the vulnerability. Ensure Cache-Control headers are set correctly and include the Vary header to prevent shared cache issues.

Hi! I’m here to help you understand CVE-2026-82755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70