Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_authentication_oauth2_server

6 known vulnerabilities (1 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 high, 5 medium
Registry
Hex

Advisories 6

  • CVE-2026-82758Medium 6.3

    ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

    Affected: from 0.1.0, fixed in 0.3.1; from 0.1.0, fixed in 0.3.1.

  • CVE-2026-82757Medium 6.3

    ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

    Affected: from 0.3.0, fixed in 0.3.1; from 0.3.0, fixed in 0.3.1.

  • CVE-2026-82756Medium 6.3

    ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header…

    Affected: from 0.1.3, fixed in 0.3.1; from 0.1.3, fixed in 0.3.1.

  • CVE-2026-82755Medium 6.3

    ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

    Affected: from 0.1.3, fixed in 0.3.1; from 0.1.3, fixed in 0.3.1.

  • CVE-2026-82754Medium 6.3

    ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

    Affected: from 0.1.0, fixed in 0.3.1; from 0.1.0, fixed in 0.3.1.

  • Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

    Affected: from 0.3.0, fixed in 0.3.1; from 0.3.0, fixed in 0.3.1.