CVE-2026-82753 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
A vulnerability allowing unauthenticated resource exhaustion has been identified in the Ash Project's `ash_authentication_oauth2_server` package, specifically in versions 0.3.0 prior to 0.3.1. This vulnerability arises from the `/authorize` endpoint, which is intentionally left unauthenticated. When Client ID Metadata Documents (CIMD) are enabled, the `resolve_client/3` function fetches metadata for each new URL-shaped `client_id` and creates a corresponding client row in the database. There are no restrictions on the number of rows that can be added, no expiration or garbage collection for these entries, and no limits on the length of the fetched data. Additionally, the metadata documents are cached before they are validated, allowing even rejected documents to occupy memory until their time-to-live (TTL) expires. An attacker can exploit this by serving valid metadata documents from multiple distinct URLs, resulting in the creation of permanent client rows that can each hold several megabytes of data. This unregulated growth can lead to a significant depletion of both database storage and memory resources.
Users can update to `ash_authentication_oauth2_server` version 0.3.1, which addresses this vulnerability by introducing a length limit on fetched metadata documents, validating documents before caching them, and adding a `ClientResource` extension that automatically removes stale CIMD client rows. Servers with CIMD enabled should also ensure that the `ClientResource` extension is included in their client resource.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-82753.html | EEF | AdvisoryVendor |
| https://github.com/ash-project/ash_authentication_oauth2_server/commit/45e24f69e0f95d67413e2508acc2264156acb5ac | EEF | Source CodeVendor |
| https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-9pv3-wxjm-f846 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-82753 | EEF | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash_authentication_oauth2_server | >= 0.3.0, < 0.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | EEF |