Improper Authentication in Ash Project's OAuth2 Server Affects Dynamic Client Registration

CVE-2026-82758

What is CVE-2026-82758?

The Ash Project's ash_authentication_oauth2_server contains an improper authentication vulnerability that allows unauthenticated attackers to register OAuth clients without appropriate checks. This flaw arises when the dynamic client registration process incorrectly validates initial access tokens. Specifically, when the resolved secret returns a nil, false, or an empty string, the system mistakenly allows client registration, exposing the application to unauthorized credential abuse. Versions from 0.1.0 to prior to 0.3.1 are affected, necessitating immediate action to mitigate this issue through the latest patches.

References