CVE-2026-82755: ash_authentication_oauth2_server Cross-Tenant OAuth Metadata Exposure Vulnerability
Summary
CVE-2026-82755: Use of Cache Containing Sensitive Information vulnerability in ash-project ash\_authentication\_oauth2\_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. Affects ash_authentication_oauth2_server across 2 version ranges.
>= 0.1.3, < 0.3.1
>= 99de0a1cacb5ef667c4533278b7c81ca98c00231, < 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ash_authentication_oauth2_server is a package designed for handling OAuth 2.0 authentication in multi-tenant applications. It provides essential functionalities such as managing authorization codes, token endpoints, and issuer information specific to each tenant. However, due to a misconfiguration in caching mechanisms, it is vulnerable to cross-tenant information leakage, which can lead to serious security risks.
Vulnerability Detail
The vulnerability arises from the improper handling of tenant-specific OAuth metadata, which is served as publicly cacheable without the appropriate Vary header. This allows a shared HTTP cache to deliver one tenant's OAuth discovery metadata to another tenant's clients. As a result, clients may inadvertently send sensitive authorization codes and secrets to the wrong tenant's token endpoint, leading to potential unauthorized access and token validation against incorrect keys. This issue primarily affects deployments where tenant identification is derived from headers or the Host rather than the URL.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your caching layer to avoid caching responses from the OAuth metadata endpoints or ensure that tenant identification is strictly based on the URL to prevent cross-tenant data exposure.
Conclusion
The CVE-2026-82755 vulnerability in the ash_authentication_oauth2_server package poses a significant risk in multi-tenant environments due to improper caching of OAuth metadata. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for ash_authentication_oauth2_server →
FAQ
CVE-2026-82755 is a vulnerability in the ash_authentication_oauth2_server package that allows cross-tenant OAuth metadata exposure due to improper caching.
This vulnerability can lead to unauthorized access as clients may send sensitive information to the wrong tenant's endpoints, potentially compromising security.
Versions of ash_authentication_oauth2_server from 0.1.3 to 0.3.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication_oauth2_server.
