CVE-2026-82757mediumCWE-918

CVE-2026-82757: fallo de gravedad media en ash-project ash_authentication_oauth2_server

ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ash authentication oauth2 server+ Monitorear ash_authentication_oauth2_server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.7%
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Productos afectados
ash-project · ash_authentication_oauth2_server
CVEs relacionadas — ash-project ash_authentication_oauth2_server

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-82754MEDIUMash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsEPSS 0.7%CVE-2026-82758MEDIUMash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpointEPSS 0.7%CVE-2026-82756MEDIUMash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injectionEPSS 0.7%CVE-2026-82753HIGHUnauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverEPSS 0.7%CVE-2026-82755MEDIUMash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusionEPSS 0.7%