Executive brief
The ash_authentication_oauth2_server library handles OAuth 2.0 authentication for multi-tenant Elixir applications. A caching misconfiguration causes shared HTTP caches to serve one tenant's OAuth configuration to another tenant's clients, potentially enabling attackers to intercept authorization codes and credentials meant for the legitimate tenant.
Technical details
The vulnerability is a cache poisoning issue in the RFC 8414 and RFC 9728 OAuth 2.0 metadata endpoints (ProtocolRouter). The endpoints return tenant-specific metadata (issuer, authorization_endpoint, token_endpoint, jwks_uri) but mark responses with Cache-Control: public, max-age=3600 without a Vary header. When tenant identity is derived from non-URL sources (HTTP headers or Host header) and a shared cache intercepts traffic, the cache key becomes the URL alone. This allows a cached response for one tenant to be served to another for up to 3,600 seconds. An attacker can manipulate tenant selection to poison the cache, causing legitimate clients to send authorization codes and secrets to the attacker's token endpoint or validate tokens against the attacker's keys. The issue affects versions 0.1.3 through 0.3.0; upgrading to 0.3.1 or later resolves the problem.
Affected products
- ash-project ash_authentication_oauth2_server 0.1.3 through 0.3.0
Timeline
- 2026-09-07: disclosed