EUVD-2026-72536Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H maps the CVSS 4.0 AT:P precondition (path-scoped edge controls required); no confidentiality impact; only low integrity from edge-control bypass.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
AnalysisAI
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently reachable under a second, unintended URL prefix (/.well-known) due to Phoenix's forward macro stripping the matched prefix before dispatch, leaving both /oauth and /.well-known mounts backed by the same ProtocolRouter route table. POST requests to /register, /token, and /revoke therefore answer under /.well-known/register, /.well-known/token, and /.well-known/revoke, bypassing any WAF rules, rate-limiting policies, or authentication exemptions scoped exclusively to the canonical /oauth prefix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target deployment has configured edge controls - WAF rules, rate-limiting policies, IP allow/block lists, or authentication requirements - scoped specifically to the `/oauth` URL prefix while simultaneously treating `/.well-known` paths as trusted or unauthenticated (a common posture given the RFC 5785 metadata convention). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 with AT:P (Attack Requirements: Present) accurately captures that exploitation is conditional rather than universal: deployments with no path-differentiated edge controls face no incremental risk because both URL prefixes were already equally exposed to the underlying application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ash_authentication_oauth2_server 0.3.1, which introduces a `restrict_well_known_mount/2` plug in `ProtocolRouter`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow databa
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthe
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows un
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3
Same weakness CWE-424 – Improper Protection of Alternate Path
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today