CVE-2026-82754: ash_authentication_oauth2_server Path Bypass Vulnerability
Summary
CVE-2026-82754: Improper Protection of Alternate Path vulnerability in ash-project ash\_authentication\_oauth2\_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical... Affects ash_authentication_oauth2_server across 2 version ranges.
>= 0.1.0, < 0.3.1
>= 855b578037c5ded18e8a6e60f42e56bde4905fae, < a72972d7ed3eb74c05dfa0653a258ef14454459a
Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ash_authentication_oauth2_server package is a component of the Ash framework, designed to facilitate OAuth2 authentication in applications. It provides essential endpoints for user registration, token issuance, and revocation. However, due to a routing misconfiguration, it exposes sensitive endpoints under the /.well-known URL prefix, which can lead to unauthorized access if not properly secured.
Vulnerability Detail
The vulnerability arises from improper protection of alternate paths in the ash_authentication_oauth2_server package. Specifically, the OAuth endpoints are accessible under both the /oauth and /.well-known prefixes. This misconfiguration allows attackers to bypass security controls that are typically applied to the /oauth paths, potentially leading to unauthorized actions such as user registration, token issuance, and revocation. The vulnerability affects versions from 0.1.0 to before 0.3.1, and it can be exploited if the deployment relies on path-scoped edge controls that do not account for the /.well-known alias.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement additional security controls at the application level to restrict access to the /.well-known endpoints. This may include configuring your web application firewall (WAF) to block requests to these paths or implementing rate limiting and authentication checks specifically for the /.well-known prefix.
Conclusion
CVE-2026-82754 presents a significant risk to applications using the ash_authentication_oauth2_server package due to improper routing of OAuth endpoints. It is crucial to update to the latest version to mitigate this risk and ensure that appropriate security measures are in place.
See every vulnerability recorded for ash_authentication_oauth2_server →
FAQ
CVE-2026-82754 is a vulnerability in the ash_authentication_oauth2_server package that allows unauthorized access to sensitive OAuth endpoints due to improper routing.
Versions from 0.1.0 to before 0.3.1 of the ash_authentication_oauth2_server package are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the ash_authentication_oauth2_server package to version 0.3.1 or later and consider implementing additional security measures such as WAF rules.
The CVSS score of CVE-2026-82754 is 6.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication_oauth2_server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
