AS
Product
ash_authentication_oauth2_server
6
CVEs
0
On KEV
8.2
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 5Low 0
Watch
Add ash_authentication_oauth2_server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-82753 | 8.2 | Sep 7 | Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server Affected: 0.3.0 before 0.3.1; e713a9ba816761140c226e2ca55b75c0b93f5984 before 45e24f69e0f95d67413e2508acc2264156acb5ac |
| CVE-2026-82758 | 6.3 | Sep 7 | ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint Affected: 0.1.0 before 0.3.1; 855b578037c5ded18e8a6e60f42e56bde4905fae before 30a87101871775d27d79f9ad6f29eafa4779e118 |
| CVE-2026-82757 | 6.3 | Sep 7 | ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF Affected: 0.3.0 before 0.3.1; e713a9ba816761140c226e2ca55b75c0b93f5984 before 268b591261a3473ab9b87272963e4dd2fd99d972 |
| CVE-2026-82756 | 6.3 | Sep 7 | ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection Affected: 0.1.3 before 0.3.1; 99de0a1cacb5ef667c4533278b7c81ca98c00231 before 09f97476715da031b136eaec7b2cda2363ad8149 |
| CVE-2026-82755 | 6.3 | Sep 7 | ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion Affected: 0.1.3 before 0.3.1; 99de0a1cacb5ef667c4533278b7c81ca98c00231 before 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1 |
| CVE-2026-82754 | 6.3 | Sep 7 | ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls Affected: 0.1.0 before 0.3.1; 855b578037c5ded18e8a6e60f42e56bde4905fae before a72972d7ed3eb74c05dfa0653a258ef14454459a |
Showing 6