Executive brief
The ash_authentication_oauth2_server library is used to handle OAuth2 authentication in multi-tenant applications. An attacker can inject malicious authentication parameters into the WWW-Authenticate response header by crafting a tenant name containing special characters, potentially redirecting authentication requests to an attacker-controlled authorization server and compromising user login flows.
Technical details
This is an improper encoding/escaping vulnerability in the BearerPlug and RequireScopePlug components. The vulnerability occurs when the library constructs a Bearer resource_metadata challenge by directly interpolating a resource_metadata URL derived from the tenant identifier into a quoted header value without proper escaping. In multi-tenant applications where the tenant is derived from request-controlled data (subdomain, Host header, path segment), an attacker can include a double-quote character in the tenant name to close the quoted value and inject additional authentication parameters. The injected parameters can include a malicious resource_metadata URL pointing to an attacker-controlled authorization server. While Plug rejects carriage returns and line feeds, preventing response splitting, parameter injection within the single header remains possible. Affected versions are 0.1.3 through 0.3.0; version 0.3.1 and later contain the fix. No authentication is required; only network access to the vulnerable application is needed.
Affected products
- ash-project ash_authentication_oauth2_server 0.1.3 to 0.3.0
Timeline
- 2026-09-07: disclosed