# CVE-2026-82757: ash-project ash_authentication_oauth2_server SSRF in metadata fetch

Source: https://junglewise.ai/threats/cve-2026-82757-ash-project-ash-authentication-oauth2-server-ssrf-in-metadata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82757 · Severity: info · CVSS 6.5 · Published 2026-09-07

ash_authentication_oauth2_server is a library that handles OAuth 2.0 authentication with support for client metadata fetching. An attacker controlling a client's metadata URL and DNS can craft responses containing IPv6 addresses that bypass security filters, allowing connections to internal or loopback addresses that should be blocked. This could expose internal services or allow unauthorized access to backend systems.

Technologies: [Ash-Project Ash Authentication Oauth2 Server](https://junglewise.ai/threats/technologies/ash-authentication-oauth2-server). Vendors: [Ash-Project](https://junglewise.ai/threats/vendors/ash-project).

## Quick answers

**Is CVE-2026-82757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82757 being exploited in the wild.

**How severe is CVE-2026-82757?** Informational severity, with a CVSS score of 6.5, published 7 September 2026.

**Which products and versions are affected?** Ash-Project Ash Authentication Oauth2 Server 0.3.0 before 0.3.1.

**Is there a fix for CVE-2026-82757?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82757 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82757?** Check whether you run Ash-Project Ash Authentication Oauth2 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the public_ip?/1 function within AshAuthentication.Oauth2Server.CIMD.ReqFetcher. The function incorrectly classifies several IPv6 address ranges as publicly routable when they are not: IPv4-compatible ::/96 (e.g., ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. An attacker who controls a client metadata URL and its associated DNS can return AAAA records in these ranges, bypassing outbound policy checks and allowing the server to connect to internal or loopback addresses. The vulnerability affects versions 0.3.0 before 0.3.1 and is patched in 0.3.1.

## Affected products

- ash-project ash_authentication_oauth2_server 0.3.0 before 0.3.1

## Timeline

- 2026-09-07: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [ash-project ash_authentication_oauth2_server authentication bypass in client registration](https://junglewise.ai/threats/cve-2026-82758-ash-project-ash-authentication-oauth2-server-authentication)
- [ash-project ash_authentication_oauth2_server parameter injection in WWW-Authenticate header](https://junglewise.ai/threats/cve-2026-82756-ash-project-ash-authentication-oauth2-server-parameter-injection)
- [ash-project ash_authentication_oauth2_server cache poisoning in OAuth discovery metadata](https://junglewise.ai/threats/cve-2026-82755-ash-project-ash-authentication-oauth2-server-cache-poisoning-in)
- [ash-project ash_authentication_oauth2_server path traversal in OAuth endpoints](https://junglewise.ai/threats/cve-2026-82754-ash-project-ash-authentication-oauth2-server-path-traversal-in)
- [ash-project ash_authentication_oauth2_server unbound resource allocation in /authorize](https://junglewise.ai/threats/cve-2026-82753-ash-project-ash-authentication-oauth2-server-unbound-resource)