CVE-2026-82756: ash_authentication_oauth2_server Header Parameter Injection Vulnerability
Summary
CVE-2026-82756: Improper Encoding or Escaping of Output vulnerability in ash-project ash\_authentication\_oauth2\_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challeng... Affects ash_authentication_oauth2_server across 2 version ranges.
>= 0.1.3, < 0.3.1
>= 99de0a1cacb5ef667c4533278b7c81ca98c00231, < 09f97476715da031b136eaec7b2cda2363ad8149
Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ash_authentication_oauth2_server package is an OAuth2 authentication server for Elixir applications, designed to facilitate secure access to resources through token-based authentication. It supports multi-tenancy, allowing different tenants to operate within the same application environment. However, this flexibility introduces vulnerabilities when tenant-derived values are not properly sanitized, leading to potential security risks.
Vulnerability Detail
The vulnerability in ash_authentication_oauth2_server arises from improper encoding or escaping of output, specifically in the construction of the WWW-Authenticate challenge header. An unauthenticated attacker can exploit this flaw by injecting arbitrary authentication parameters into the header. This occurs when the BearerPlug and RequireScopePlug interpolate a tenant-derived resource_metadata URL directly into the challenge, allowing attackers to manipulate the header if the tenant contains a quote character. This can lead to unauthorized access to resources and the potential for redirecting clients to malicious authorization servers.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the application does not derive tenant values from untrusted sources. Implement strict validation and sanitization of any input that could affect the tenant context, especially in multi-tenant configurations.
Conclusion
The ash_authentication_oauth2_server package has a significant vulnerability that can lead to header parameter injection, posing a risk to applications using this package in multi-tenant environments. It is crucial to update to the patched version and implement proper input validation to mitigate this risk.
See every vulnerability recorded for ash_authentication_oauth2_server →
FAQ
CVE-2026-82756 is a vulnerability in the ash_authentication_oauth2_server package that allows header parameter injection due to improper encoding of tenant-derived values.
If your application uses ash_authentication_oauth2_server in a multi-tenant setup, an attacker could exploit this vulnerability to inject malicious parameters into authentication headers, potentially gaining unauthorized access.
The vulnerability affects versions of ash_authentication_oauth2_server from 0.1.3 up to, but not including, 0.3.1.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without requiring signup.
The CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication_oauth2_server.
