Executive brief
ash_authentication_oauth2_server is a library that handles OAuth 2.0 authentication with support for client metadata fetching. An attacker controlling a client's metadata URL and DNS can craft responses containing IPv6 addresses that bypass security filters, allowing connections to internal or loopback addresses that should be blocked. This could expose internal services or allow unauthorized access to backend systems.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the public_ip?/1 function within AshAuthentication.Oauth2Server.CIMD.ReqFetcher. The function incorrectly classifies several IPv6 address ranges as publicly routable when they are not: IPv4-compatible ::/96 (e.g., ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. An attacker who controls a client metadata URL and its associated DNS can return AAAA records in these ranges, bypassing outbound policy checks and allowing the server to connect to internal or loopback addresses. The vulnerability affects versions 0.3.0 before 0.3.1 and is patched in 0.3.1.
Affected products
- ash-project ash_authentication_oauth2_server 0.3.0 before 0.3.1
Timeline
- 2026-09-07: disclosed