Answer in brief
CVE-2026-82756 records a Medium severity (CVSS 6.3) vulnerability in ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection. The current sources do not mark it as known exploited. The current feed maps ash-project/ash_authentication_oauth2_server (generic), ash-project/ash_authentication_oauth2_server (generic), ash-project/ash-project/ash_authentication_oauth2_server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash_authentication_oauth2_server (generic), ash-project/ash_authentication_oauth2_server (generic), ash-project/ash-project/ash_authentication_oauth2_server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ash_authentication_oauth2_servergeneric | >=99de0a1cacb5ef667c4533278b7c81ca98c00231 <09f97476715da031b136eaec7b2cda2363ad8149 | 09f97476715da031b136eaec7b2cda2363ad8149 |
| ash-project/ash_authentication_oauth2_servergeneric | >=0.1.3 <0.3.1 | 0.3.1 |
| ash-project/ash-project/ash_authentication_oauth2_servergeneric | >=99de0a1cacb5ef667c4533278b7c81ca98c00231 <09f97476715da031b136eaec7b2cda2363ad8149 | 09f97476715da031b136eaec7b2cda2363ad8149 |
Published upstream
Sep 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 7, 2026
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting. This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Quoted source text, attributed separately from HOL analysis.