Information Exposure Vulnerability in ash-project’s OAuth 2.0 Server

CVE-2026-82755

What is CVE-2026-82755?

The ash_authentication_oauth2_server contains a vulnerability that allows sensitive OAuth discovery metadata to be cached and improperly shared across tenants. When clients of one tenant make requests, they may inadvertently receive data intended for another tenant. The metadata endpoints provide critical tenant-specific values, which are incorrectly served with a public cache configuration. This misconfiguration results in a scenario where, if a shared HTTP cache is in use, cached responses for one tenant could be served to clients of another for up to an hour. Consequently, this issue raises significant concerns regarding the integrity of sensitive authorization data and can lead to incorrect token submissions and validation against unintended endpoints.

References