EUVD-2026-72537Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because a shared cache and header-based tenant routing must both be present; S:C because cross-tenant integrity and confidentiality impact affects systems beyond the vulnerable server.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
AnalysisAI
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3.1) causes shared HTTP caches to serve one tenant's RFC 8414/RFC 9728 discovery metadata - including issuer, authorization_endpoint, token_endpoint, and jwks_uri - to another tenant's clients for up to one hour. The vulnerability arises because the Phoenix ProtocolRouter sent all metadata responses with Cache-Control: public, max-age=3600 and no Vary header; when tenant identity is derived from a request header or Host (not the URL), shared caches key on URL alone, making cross-tenant cache poisoning trivially repeatable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions simultaneously: (1) the deployment is multi-tenant, (2) tenant identity is derived from something other than the URL - specifically a request header (e.g., X-Tenant-ID) or the HTTP Host header - so that two tenants share the same /.well-known/ URL, and (3) a shared HTTP cache (CDN, reverse proxy with caching, or similar) sits between clients and the Phoenix application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N is accurate and well-calibrated: AT:P (specific attack requirement: a shared cache must be present) is the key gating condition, correctly preventing inflation to a higher score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ash_authentication_oauth2_server 0.3.1, which replaces the unconditional Cache-Control: public, max-age=3600 header with a tenant-aware helper that emits Cache-Control: private, max-age=3600 whenever a tenant is set on the connection. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow databa
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthe
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows un
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today