EUVD-2026-72538Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires specific multi-tenant configuration with request-derived tenant (AC:H); no auth needed (PR:N); scope changes to OAuth2 clients following the injected resource_metadata URL (S:C).
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.
BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
AnalysisAI
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows unauthenticated network attackers to smuggle arbitrary OAuth2 auth-params into Bearer challenge headers by supplying a tenant value containing a double-quote character. In multi-tenant Elixir/Phoenix applications that derive the Ash tenant from request-controlled data such as subdomains, Host headers, or path segments, an attacker can inject a second resource_metadata URL pointing to an attacker-controlled authorization server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target application uses ash_authentication_oauth2_server versions 0.1.3-0.3.0 with BearerPlug or RequireScopePlug active; (2) the application is deployed in multi-tenant mode where the Ash tenant is derived from attacker-controlled request data - specifically from the Host header, a subdomain, a URL path segment, or a request header - and that tenant value is embedded into the resource_metadata URL without sanitization; (3) an OAuth2 client consuming the application's Bearer challenges is spec-compliant and will follow the resource_metadata URL for authorization server discovery. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, score 6.3) accurately captures the attack's posture: network-reachable and requiring no authentication, but constrained by a prerequisite configuration condition - the application must be multi-tenant with a request-derived tenant value embedded in the resource_metadata URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ash_authentication_oauth2_server version 0.3.1 or later, which introduces a centralized bearer_challenge/1 function in the Errors module that properly escapes all auth-param values as RFC 7235 quoted-strings, backslash-escaping any embedded double-quote characters before header construction. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow databa
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthe
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today