ash_authentication_oauth2_server CVE-2026-82753

The Client ID Metadata Documents (CIMD) feature must be explicitly enabled in the ash_authentication_oauth2_server configuration (cimd_enabled?: true). This is a non-default opt-in feature; deployments without CIMD enabled are entirely unaffected regardless of version. When CIMD is enabled, the /authorize endpoint is unauthenticated by design, so no credentials or session are required, and exploitation is fully remote with no user interaction. Exploitation is limited to versions 0.3.0 (the version introducing CIMD); 0.3.1 resolves the issue. The attacker must be able to serve HTTP responses at attacker-controlled URLs reachable from the server's network (the server fetches attacker-provided metadata documents), meaning outbound HTTP connectivity from the server to arbitrary URLs is also required.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) reflects a high-impact, network-exploitable availability threat contingent on a specific deployment condition (AT:P): the CIMD feature must be explicitly enabled. This is a non-default configuration - operators must opt into CIMD, so the realistic exposed population is a subset of all ash_authentication_oauth2_server deployments. Within that subset, exploitation is straightforward: no authentication, no complexity, fully automatable. The impact is availability-only; confidentiality and integrity are unaffected. EPSS data was not provided; given the niche library footprint and configuration dependency, widespread scanning-based exploitation is unlikely but targeted attacks against known CIMD-enabled instances remain plausible. No KEV listing and no public exploit code lower immediate urgency for non-CIMD deployments. Deployments with CIMD enabled and high request volume face the most concrete risk of storage/memory exhaustion.

An attacker hosts a web server that serves valid OAuth2 client metadata documents at thousands of distinct URLs. They send repeated POST requests to the target's /authorize endpoint, each using a different URL as the client_id parameter. Each unique URL triggers resolve_client/3 to fetch the attacker's document and upsert a new permanent database row containing multi-megabyte attacker-controlled strings, while simultaneously filling CIMD.Cache. Continued over hours, this exhausts available database storage and application memory, causing the service to become unavailable.