Description
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.

The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.

This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Published: 2026-09-07
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Patch Now
AI Analysis

Impact

When the OAuth discovery endpoints serve tenant‑specific values via a shared HTTP cache without a Vary header, a cached response from one tenant can be served to another tenant’s clients. This allows an attacker to route authorization codes and client secrets to the wrong tenant’s token endpoint and to validate tokens against the wrong key set, thereby bypassing tenant isolation and potentially exposing data or granting unauthorized access.

Affected Systems

The affected product is ash_authentication_oauth2_server versions 0.1.3 through just before 0.3.1.

Risk and Exploitability

The CVSS base score of 6.3 denotes medium severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the missing Vary header makes the flaw trivially exploitable whenever a shared cache sits in front of the server. Exposure is not yet reported in the CISA KEV catalog. Attackers can trigger the issue by requesting the OAuth discovery endpoints; no special authentication is required on the server side, and the cached response may serve cross‑tenant clients for up to one hour.

Generated by OpenCVE AI on September 7, 2026 at 23:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash_authentication_oauth2_server to version 0.3.1 or later.
  • Configure the server to return a Vary header that includes the tenant‑identifying header (e.g., Host or X‑Tenant) and remove the Cache‑Control: public directive from the discovery responses, or set the value to private.
  • If a reverse proxy or CDN is deployed, ensure that the cache key incorporates tenant‑specific headers; otherwise disable caching for the OAuth discovery endpoints.

Generated by OpenCVE AI on September 7, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Description Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys. This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Title ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
First Time appeared Ash-project
Ash-project ash Authentication Oauth2 Server
Weaknesses CWE-524
CPEs cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Authentication Oauth2 Server
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Ash-project Ash Authentication Oauth2 Server
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-08T14:42:17.718Z

Reserved: 2026-08-31T01:00:10.817Z

Link: CVE-2026-82755

cve-icon Vulnrichment

Updated: 2026-09-08T14:42:14.024Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T23:16:52.580

Modified: 2026-09-08T15:18:50.490

Link: CVE-2026-82755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T20:36:41Z

Weaknesses
  • CWE-524

    Use of Cache Containing Sensitive Information