Executive brief
ash_authentication_oauth2_server is an OAuth 2.0 server library used to authenticate users and authorize third-party application access. A flaw in how it handles secret validation allows attackers to bypass the initial access token requirement and register unauthorized OAuth clients even when client registration should be restricted. This could let an attacker register malicious applications with excessive permissions, compromising the security of systems relying on this OAuth implementation.
Technical details
The vulnerability exists in the resolve_secret/3 function of AshAuthentication.Oauth2Server, which handles secret resolution from configured providers. The function treats any return value other than {:ok, _} or :error as a valid secret, incorrectly wrapping nil, false, or empty string ("") as {:ok, value}. When initial_access_token resolution fails and returns an empty value, the subsequent bearer token comparison in POST /oauth/register passes even with no token supplied, effectively disabling access control. The same fail-open behavior affects other critical secrets such as signing_secret, amplifying the security impact. Attack vector is network-based with no authentication or user interaction required.
Affected products
- ash-project ash_authentication_oauth2_server 0.1.0 to 0.3.0
Timeline
- 2026-09-07: disclosed
- 2026-09-07: advisory