CVE-2026-82757

Received Received - Intake

SSRF in AshAuthentication OAuth2 Server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82757

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_authentication_oauth2_server	From 0.3.0 (inc) to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the ash_authentication_oauth2_server component. It allows an attacker who controls a client metadata URL and its DNS to trick the server into making unauthorized connections to internal or loopback network addresses. The issue occurs because the server incorrectly classifies certain IPv6 address ranges as publicly routable when they should be blocked.

Detection Guidance

This vulnerability is specific to the ash_authentication_oauth2_server component and involves improper handling of IPv6 addresses in outbound requests. Detection requires checking if the affected version (0.3.0 to before 0.3.1) is installed and if the server processes OAuth2 metadata URLs that could be manipulated via DNS or client metadata.

Impact Analysis

An attacker could exploit this to access internal services or systems that should not be exposed to the public internet. This might allow them to probe internal networks, interact with sensitive services, or exfiltrate data from restricted areas of your infrastructure.

Compliance Impact

This SSRF vulnerability could allow attackers to bypass network restrictions and access internal or loopback addresses, potentially exposing sensitive data. This may violate GDPR's requirement for protecting personal data and HIPAA's safeguards for protected health information by enabling unauthorized network access.

Mitigation Strategies

Update ash_authentication_oauth2_server to version 0.3.1 or later to address the SSRF vulnerability in the CIMD metadata fetcher.

Hi! I’m here to help you understand CVE-2026-82757. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70