Is CVE-2026-82758 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82758 being exploited in the wild.

How severe is CVE-2026-82758?

Informational severity, with a CVSS score of 7.5, published 7 September 2026.

Which products and versions are affected?

Ash-Project Ash Authentication Oauth2 Server 0.1.0 to 0.3.0.

Is there a fix for CVE-2026-82758?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82758 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82758?

Check whether you run Ash-Project Ash Authentication Oauth2 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82758: ash-project ash_authentication_oauth2_server authentication bypass in client registration

CVE-2026-82758 · Severity: info · CVSS 7.5 · Published 2026-09-07

ash_authentication_oauth2_server is an OAuth 2.0 server library used to authenticate users and authorize third-party application access. A flaw in how it handles secret validation allows attackers to bypass the initial access token requirement and register unauthorized OAuth clients even when client registration should be restricted. This could let an attacker register malicious applications with excessive permissions, compromising the security of systems relying on this OAuth implementation.

Technologies: Ash-Project Ash Authentication Oauth2 Server. Vendors: Ash-Project.

Quick answers

Is CVE-2026-82758 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82758 being exploited in the wild.
How severe is CVE-2026-82758?: Informational severity, with a CVSS score of 7.5, published 7 September 2026.
Which products and versions are affected?: Ash-Project Ash Authentication Oauth2 Server 0.1.0 to 0.3.0.
Is there a fix for CVE-2026-82758?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82758 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82758?: Check whether you run Ash-Project Ash Authentication Oauth2 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the resolve_secret/3 function of AshAuthentication.Oauth2Server, which handles secret resolution from configured providers. The function treats any return value other than {:ok, _} or :error as a valid secret, incorrectly wrapping nil, false, or empty string ("") as {:ok, value}. When initial_access_token resolution fails and returns an empty value, the subsequent bearer token comparison in POST /oauth/register passes even with no token supplied, effectively disabling access control. The same fail-open behavior affects other critical secrets such as signing_secret, amplifying the security impact. Attack vector is network-based with no authentication or user interaction required.

Affected products

ash-project ash_authentication_oauth2_server 0.1.0 to 0.3.0

Timeline

2026-09-07: disclosed
2026-09-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.