CVE-2026-82757: ash_authentication_oauth2_server SSRF Vulnerability in CIMD Fetcher
Summary
CVE-2026-82757: Server-Side Request Forgery (SSRF) vulnerability in ash-project ash\_authentication\_oauth2\_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback add... Affects ash_authentication_oauth2_server across 2 version ranges.
>= 0.3.0, < 0.3.1
>= e713a9ba816761140c226e2ca55b75c0b93f5984, < 268b591261a3473ab9b87272963e4dd2fd99d972
Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ash_authentication_oauth2_server is a package designed for OAuth2 authentication in applications built with the Ash framework. It enables secure handling of client metadata and facilitates the authorization process. However, this package has a vulnerability that allows attackers to exploit the system by manipulating metadata URLs, leading to potential unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from a Server-Side Request Forgery (SSRF) flaw in the ash_authentication_oauth2_server package. Specifically, the CIMD fetcher incorrectly classifies certain IPv6 address formats, such as IPv4-in-IPv6 and site-local addresses, as public. This misclassification allows an attacker controlling a client metadata URL to make the server connect to internal or loopback addresses, bypassing security measures intended to block such requests. The affected versions are from 0.3.0 before 0.3.1, which could lead to unauthorized access to sensitive internal services.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the Client ID Metadata Documents feature by setting 'cimd_enabled' to false in your configuration. This will prevent the fetching of attacker-suppliable metadata URLs until you can apply the patch.
Conclusion
The CVE-2026-82757 vulnerability in the ash_authentication_oauth2_server package poses a significant risk due to its SSRF nature, allowing attackers to access internal resources. It is crucial to update to the patched version 0.3.1 or later to mitigate this risk effectively. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ash_authentication_oauth2_server →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The risks include unauthorized access to internal services, data leakage, and potential exploitation of other vulnerabilities within the internal network.
Yes, you can temporarily disable the Client ID Metadata Documents feature as a workaround until you can apply the update.
The CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication_oauth2_server.
