Quick answers
- Is CVE-2026-82755 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82755 being exploited in the wild.
- How severe is CVE-2026-82755?
- Informational severity, published 7 September 2026.
- Which products and versions are affected?
- Ash-Project Ash Authentication Oauth2 Server 0.1.3 through 0.3.0.
- Is there a fix for CVE-2026-82755?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82755 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82755?
- Check whether you run Ash-Project Ash Authentication Oauth2 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a cache poisoning issue in the RFC 8414 and RFC 9728 OAuth 2.0 metadata endpoints (ProtocolRouter). The endpoints return tenant-specific metadata (issuer, authorization_endpoint, token_endpoint, jwks_uri) but mark responses with Cache-Control: public, max-age=3600 without a Vary header. When tenant identity is derived from non-URL sources (HTTP headers or Host header) and a shared cache intercepts traffic, the cache key becomes the URL alone. This allows a cached response for one tenant to be served to another for up to 3,600 seconds. An attacker can manipulate tenant selection to poison the cache, causing legitimate clients to send authorization codes and secrets to the attacker's token endpoint or validate tokens against the attacker's keys. The issue affects versions 0.1.3 through 0.3.0; upgrading to 0.3.1 or later resolves the problem.
Affected products
- ash-project ash_authentication_oauth2_server 0.1.3 through 0.3.0
Timeline
- 2026-09-07: disclosed