CVE-2026-82756

Received Received - Intake

Authentication Parameter Injection in ash_authentication_oauth2_server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting. This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82756

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_authentication_oauth2_server	From 0.1.3 (inc) to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper encoding of output in the ash_authentication_oauth2_server component. An unauthenticated attacker can inject arbitrary authentication parameters into the WWW-Authenticate challenge header by manipulating the tenant value in a multi-tenant application. The attacker crafts a tenant string containing a quote character to close the quoted header value and append malicious parameters, including a resource_metadata URL pointing to an attacker-controlled server.

Detection Guidance

Detecting this vulnerability requires checking for improperly encoded tenant values in the WWW-Authenticate header. Inspect HTTP responses for Bearer challenges with malformed resource_metadata parameters. Look for tenants containing quotes or unexpected characters in headers like Host, subdomain, or path segments.

Impact Analysis

An attacker could trick users into authenticating against a malicious authorization server, potentially stealing credentials or session tokens. This could lead to unauthorized access to protected resources or data breaches. The impact depends on the application's configuration and the privileges of the compromised accounts.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, regulatory fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade ash_authentication_oauth2_server to version 0.3.1 or later. Ensure tenant values are properly validated and escaped before being used in authentication headers. Disable multi-tenancy if tenant values are derived from untrusted request data.

Hi! I’m here to help you understand CVE-2026-82756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70