Is CVE-2026-82756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82756 being exploited in the wild.

How severe is CVE-2026-82756?

Informational severity, published 7 September 2026.

Which products and versions are affected?

Ash-Project Ash Authentication Oauth2 Server 0.1.3 to 0.3.0.

Is there a fix for CVE-2026-82756?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82756 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82756?

Check whether you run Ash-Project Ash Authentication Oauth2 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82756: ash-project ash_authentication_oauth2_server parameter injection in WWW-Authenticate header

CVE-2026-82756 · Severity: info · Published 2026-09-07

The ash_authentication_oauth2_server library is used to handle OAuth2 authentication in multi-tenant applications. An attacker can inject malicious authentication parameters into the WWW-Authenticate response header by crafting a tenant name containing special characters, potentially redirecting authentication requests to an attacker-controlled authorization server and compromising user login flows.

Technologies: Ash-Project Ash Authentication Oauth2 Server. Vendors: Ash-Project.

Quick answers

Is CVE-2026-82756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82756 being exploited in the wild.
How severe is CVE-2026-82756?: Informational severity, published 7 September 2026.
Which products and versions are affected?: Ash-Project Ash Authentication Oauth2 Server 0.1.3 to 0.3.0.
Is there a fix for CVE-2026-82756?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82756 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82756?: Check whether you run Ash-Project Ash Authentication Oauth2 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper encoding/escaping vulnerability in the BearerPlug and RequireScopePlug components. The vulnerability occurs when the library constructs a Bearer resource_metadata challenge by directly interpolating a resource_metadata URL derived from the tenant identifier into a quoted header value without proper escaping. In multi-tenant applications where the tenant is derived from request-controlled data (subdomain, Host header, path segment), an attacker can include a double-quote character in the tenant name to close the quoted value and inject additional authentication parameters. The injected parameters can include a malicious resource_metadata URL pointing to an attacker-controlled authorization server. While Plug rejects carriage returns and line feeds, preventing response splitting, parameter injection within the single header remains possible. Affected versions are 0.1.3 through 0.3.0; version 0.3.1 and later contain the fix. No authentication is required; only network access to the vulnerable application is needed.

Affected products

ash-project ash_authentication_oauth2_server 0.1.3 to 0.3.0

Timeline

2026-09-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.