CVE-2026-82758

ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

View on CVE.org

Published Sep 7, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.

resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.

This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.

Analysis

Technical impact

The server treats any return value from the configured secret provider that is not {:ok, _} or :error as a valid secret, wrapping nil, false, or an empty string into {:ok, value}. When the initial access token resolves to such an empty secret, POST /oauth/register compares the supplied bearer token to this resolved secret; because the secret is effectively empty, the comparison succeeds even when no token is supplied. Consequently, the gated Dynamic Client Registration endpoint becomes open to anyone, allowing unauthenticated registration of OAuth clients and potentially yielding client credentials for malicious applications.

Affected Systems

ash-project's ash_authentication_oauth2_server, versions 0.1.0 through 0.3.0 (inclusive).

Risk and Exploitability

The vulnerability has a CVSS score of 6.3, indicating moderate severity. No EPSS data is available. The vulnerability is not listed in CISA KEV. An attacker can remotely exploit it by sending an unauthenticated POST request to the /oauth/register endpoint to create a new client application.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ash-project

ash_authentication_oauth2_server

unaffected

Version	Status	Constraints
`0.1.0`	affected	< 0.3.1

ash-project

ash_authentication_oauth2_server

unaffected

Version	Status	Constraints
`855b578037c5ded18e8a6e60f42e56bde4905fae`	affected	< 30a87101871775d27d79f9ad6f29eafa4779e118

No data.

Vendor Product Versions

Ash-project

Ash Authentication Oauth2 Server

Version	Status	Scheme	Platform
`[0.1.0,0.3.1)`	affected	semver	—
`[855b578037c5ded18e8a6e60f42e56bde4905fae,30a87101871775d27d79f9ad6f29eafa4779e118)`	affected	code_commit	—

Ash-project

Ash Authentication Oauth2 Server

Version	Status	Scheme	Platform
`[0.1.0,0.3.1)`	affected	semver	—

Ash-project

Ash Authentication Oauth2 Server

Version	Status	Scheme	Platform
`[855b578037c5ded18e8a6e60f42e56bde4905fae,30a87101871775d27d79f9ad6f29eafa4779e118)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update ash_authentication_oauth2_server to version 0.3.1 or later where the bug is fixed.
If an immediate upgrade is not possible, disable the Dynamic Client Registration endpoint or require that the resolved initial access token must be non‑empty before accepting a request.
Configure the secret provider to never return nil, false, or an empty string, or add an explicit check in your deployment to reject empty secrets before the registration logic runs.

Generated by OpenCVE AI on September 7, 2026 at 23:51 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.686% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-82758.html
https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118
https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw
https://osv.dev/vulnerability/EEF-CVE-2026-82758

History

Sep 8, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 7, 2026 10:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Title		ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
First Time appeared		Ash-project Ash-project ash Authentication Oauth2 Server
Weaknesses		CWE-287
CPEs		cpe:2.3:a:ash-project:ash_authentication_oauth2_server::::::::
Vendors & Products		Ash-project Ash-project ash Authentication Oauth2 Server
References		https://cna.erlef.org/cves/CVE-2026-82758.html https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118 https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw https://osv.dev/vulnerability/EEF-CVE-2026-82758
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`