CVE-2026-82758 Details
Description
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
A vulnerability in the ash-project's ash_authentication_oauth2_server package, specifically in versions 0.1.0 prior to 0.3.1, allows unauthenticated attackers to register OAuth clients. This issue arises because the server's Dynamic Client Registration feature, which is supposed to require an initial access token, fails to properly validate secrets from configured secret providers. When the initial access token provider returns an empty value or an error, the registration gate incorrectly assumes no token is needed, thus opening the registration process to unauthorized users. This flaw also impacts other secret resolutions, such as signing secrets, issuer URLs, and resource URLs.
Users can upgrade to ash_authentication_oauth2_server version 0.3.1 or later, where this vulnerability is fixed. In version 0.3.1, the secret resolution process was corrected to fail closed, ensuring that empty or erroneous secret values are not accepted as valid. For users unable to upgrade, it is crucial to ensure that the secret provider consistently returns a non-empty binary for all configured secrets, although this does not address the fundamental fail-open issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-82758.html | EEF | AdvisoryBundle |
| https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-82758 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash-project ash_authentication_oauth2_server | >= 0.1.0, < 0.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | EEF |