The vulnerability arises from the /authorize endpoint's design, which can be accessed without authentication. When Client ID Metadata Documents are enabled, each unique URL‑shaped client ID causes the server to create or overwrite a database row and to cache the fetched document. Because there is no cap on the number of rows, no expiry mechanism, and no length restriction on the stored fields, an attacker can supply documents at arbitrarily many URLs. Valid documents produce permanent client rows that can hold multi‑megabyte strings, while even rejected documents consume cache memory until their TTL. The result is uncontrolled growth of database storage and memory usage, exposing the system to resource exhaustion and a denial‑of‑service condition. This flaw is a classic Resource Allocation Without Limits (CWE‑770).

The affected product is ash-project's ash_authentication_oauth2_server. The vulnerability exists in releases from 0.3.0 up to, but not including, 0.3.1. Users deployed on these versions are susceptible. The reference CPE identifier is cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*.

The CVSS score is 8.2, indicating a high severity flaw. With the /authorize endpoint open to unauthenticated requests, the attack surface is large; no special privileges or network segmentation are required. An attacker may simply direct traffic to the endpoint, supply a large set of forged client URLs, and force the server to create thousands of client rows and cache entries. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the high CVSS and the lack of mitigation controls make exploitation quite plausible. Given this scenario, an adversary could consume database disk space and memory, potentially triggering crashes, degraded performance, or service unavailability for legitimate users.