ash_authentication_oauth2_server CVE-2026-82756

Exploitation requires three concurrent conditions: (1) the target application uses ash_authentication_oauth2_server versions 0.1.3-0.3.0 with BearerPlug or RequireScopePlug active; (2) the application is deployed in multi-tenant mode where the Ash tenant is derived from attacker-controlled request data - specifically from the Host header, a subdomain, a URL path segment, or a request header - and that tenant value is embedded into the resource_metadata URL without sanitization; (3) an OAuth2 client consuming the application's Bearer challenges is spec-compliant and will follow the resource_metadata URL for authorization server discovery. Single-tenant deployments, or multi-tenant deployments where tenants are validated to exclude double-quote characters before being set, are not vulnerable. CRLF injection is not possible because Plug rejects carriage returns and line feeds in header values, limiting the attack to same-line parameter injection within the WWW-Authenticate header.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, score 6.3) accurately captures the attack's posture: network-reachable and requiring no authentication, but constrained by a prerequisite configuration condition - the application must be multi-tenant with a request-derived tenant value embedded in the resource_metadata URL. Real-world risk is therefore conditional; a straightforward single-tenant deployment is entirely unaffected. The downstream impact falls on OAuth2 clients that follow the injected resource_metadata URL and use the attacker's authorization server, which could result in token exfiltration or credential phishing against end users. Even a mid-sized deployment in ustka running a multi-tenant Phoenix OAuth2 server should treat this as urgent if tenant values are sourced from request data such as subdomains. EPSS data was not provided in the intelligence gathered, and the vulnerability has not been added to the CISA KEV catalog; no public exploit code has been identified. The absence of active exploitation signals, combined with the prerequisite configuration requirement, positions this as medium practical urgency rather than a critical emergency - but the no-authentication prerequisite and automatic exploitability in affected multi-tenant deployments make patching the unambiguous course of action.

An attacker targeting a multi-tenant Phoenix application that derives the Ash tenant from the request Host header submits a crafted host value such as victim", scope="admin", resource_metadata="https://evil.attacker.example.com/mcp which the application embeds into the resource_metadata URL without escaping. The resulting 401 WWW-Authenticate header contains a second resource_metadata param pointing to the attacker's server. A spec-compliant OAuth2 client receiving that response follows the injected URL, retrieves the attacker's server metadata, and is directed to the attacker's authorization endpoint where tokens or credentials are collected.