ash_authentication_oauth2_server EUVD-2026-72539

Exploitation requires two specific preconditions: (1) the attacker must be able to supply or influence an OAuth2 client's metadata URL - either by registering a new client if dynamic registration is open, or by compromising an existing client registration - because the vulnerability is only triggered during CIMD metadata fetches; and (2) the attacker must control DNS resolution for the metadata URL hostname to serve a crafted AAAA record in the ::/96, ::ffff:0:0:0/96, or fec0::/10 IPv6 ranges. Deployments that do not use CIMD (i.e., do not fetch dynamic client metadata from external URLs) are not affected. The CVSS 4.0 subsequent-system impact of SC:L (and VC:N/VI:N/VA:N) indicates the primary risk is probing adjacent internal services, not direct compromise of the vulnerable host itself.

The vendor-supplied CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N) accurately captures the threat profile. AT:P reflects the specific preconditions required - the attacker must control both an OAuth2 client metadata URL and DNS for that domain - which materially constrains opportunistic exploitation. Impact is limited to probing internal services reachable from the application server (SC:L); the vulnerable system's own confidentiality and integrity are not directly compromised. The most dangerous reachable target is a cloud instance metadata endpoint (e.g., 169.254.254.169 reachable as ::169.254.169.254), which could yield cloud credentials. No CISA KEV listing exists and no public POC code has been identified, suggesting this has not seen widespread in-the-wild exploitation. EPSS data is absent from the provided intelligence. Overall this is a real but constrained vulnerability whose practical risk is highest in cloud-hosted deployments where the instance metadata service is accessible.

An attacker registers an OAuth2 client (or modifies an existing registration) pointing its CIMD metadata URL to an attacker-controlled hostname, then configures a DNS server to return an AAAA record of ::127.0.0.1 or ::169.254.169.254 for that hostname. When ash_authentication_oauth2_server fetches the client metadata, public_ip?/1 evaluates the ::/96 address as public and proceeds with the connection, reaching the loopback interface or the cloud instance metadata service, potentially disclosing IAM credentials or other internal service responses.