Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.

oauth2serverprotocolroutes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.

This issue affects ashauthenticationoauth2server: from 0.1.0 before 0.3.1.

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.

The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorizationendpoint, tokenendpoint, jwksuri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.

This issue affects ashauthenticationoauth2server: from 0.1.3 before 0.3.1.

Server-Side Request Forgery (SSRF) vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.

publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.

This issue affects ashauthenticationoauth2server: from 0.3.0 before 0.3.1.

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.

resolvesecret/3 in AshAuthentication.Oauth2Server (reached through resolvesecret!) treated any return other than {:ok, } or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initialaccesstoken resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signingsecret.

This issue affects ashauthenticationoauth2server: from 0.1.0 before 0.3.1.