CVE-2026-82753: Ash OAuth2 Server DOS Vulnerability

CVE-2026-82753 Overview

CVE-2026-82753 is an unauthenticated resource exhaustion vulnerability in the ash_authentication_oauth2_server library maintained by the ash-project. The flaw resides in the Client ID Metadata Documents (CIMD) handling logic exposed through the /authorize endpoint. When CIMD is enabled, the server fetches and persists client metadata for every unique URL-shaped client_id it receives, with no row cap, no expiration, no garbage collection, and no length limits on stored fields. An attacker can force the server to create an unbounded number of permanent client records containing multi-megabyte strings, exhausting database storage and memory. The issue affects versions from 0.3.0 before 0.3.1 and is tracked under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
An unauthenticated remote attacker can exhaust database storage and process memory on any deployment running a vulnerable version with CIMD enabled, degrading or halting authentication services.

Affected Products

ash-project ash_authentication_oauth2_server version 0.3.0
ash-project ash_authentication_oauth2_server versions after 0.3.0 and before 0.3.1
Elixir applications using CIMD via AshAuthentication.Oauth2Server.CIMD

Discovery Timeline

2026-09-07 - CVE-2026-82753 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82753

Vulnerability Analysis

The /authorize endpoint is unauthenticated by design, following the OAuth2 authorization code flow. When CIMD is enabled, the endpoint accepts URL-shaped client_id values and treats each unique URL as a discoverable client identity. The function resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the referenced metadata document over HTTP and upserts a corresponding client row into the application database.

The implementation lacks three critical controls. First, no maximum row count is enforced on the CIMD-managed client table. Second, no expiration or garbage collection routine removes stale entries. Third, no length bounds are applied to the fetched document fields before persistence. Additionally, the fetched document is written into CIMD.Cache before validation, so even rejected documents consume cache memory until their time-to-live elapses.

Root Cause

The root cause is missing throttling and lifecycle management around externally-triggered resource allocation. The design assumes CIMD client_id URLs correspond to legitimate, long-lived clients, but nothing in the code path validates that assumption before making persistent storage commitments.

Attack Vector

An attacker hosts valid CIMD documents at a large number of distinct URLs, each padded with multi-megabyte string fields. The attacker then issues sequential unauthenticated requests to /authorize referencing each URL as the client_id. Every request causes the server to fetch the document, upsert a new permanent client row, and populate the CIMD cache. Storage and memory usage grow without bound, eventually exhausting both.

text

# Source: https://github.com/ash-project/ash_authentication_oauth2_server/commit/45e24f69e0f95d67413e2508acc2264156acb5ac
# Patch to lib/ash_authentication/oauth2_server.ex
     quote bind_quoted: [opts: opts] do
       Oauth2Server.__validate_opts__!(__MODULE__, opts)
 
+      # Fail closed at compile time if CIMD is enabled without the client-resource
+      # garbage-collection extension — see __verify_cimd_support__!/1. Deferred to
+      # @after_verify so the client resource is fully compiled before we introspect it.
+      @after_verify {Oauth2Server, :__verify_cimd_support__!}
+
       @oauth2_server_opts Keyword.merge(Oauth2Server.__default_opts__(), opts)

The fix requires the ClientResource extension and adds a last_used_at attribute so unused CIMD clients can be garbage collected. See the GitHub Security Advisory GHSA-9pv3-wxjm-f846 for the full remediation.

Detection Methods for CVE-2026-82753

Indicators of Compromise

Rapid growth in the CIMD client table row count, particularly with cimd_url values pointing to unrelated or newly-registered domains.
Elevated outbound HTTP requests from the application server to a wide range of external URLs triggered by /authorize traffic.
Sustained high memory usage in the BEAM VM correlated with entries in CIMD.Cache.
Unusually large string values stored in CIMD client attributes exceeding expected metadata sizes.

Detection Strategies

Monitor the rate of new CIMD client row inserts and alert when it exceeds a legitimate baseline for the application.
Inspect application logs for repeated unauthenticated /authorize requests carrying distinct URL-shaped client_id values from the same source IP or IP range.
Track the total size of the CIMD client table and cache footprint over time to detect abnormal growth trajectories.

Monitoring Recommendations

Instrument the resolve_client/3 code path with telemetry counters and emit metrics on document size and fetch frequency.
Enable database-side alerting on table growth rate for the CIMD client resource.
Log source IPs and client_id URLs for every CIMD document fetch to support after-the-fact forensic review.

How to Mitigate CVE-2026-82753

Immediate Actions Required

Upgrade ash_authentication_oauth2_server to version 0.3.1 or later.
If upgrading immediately is not possible, disable CIMD support in the OAuth2 server configuration.
Review the CIMD client table for suspicious rows created before the upgrade and purge entries that do not correspond to legitimate integrations.
Rate-limit unauthenticated requests to the /authorize endpoint at the reverse proxy or load balancer.

Patch Information

The fix is included in ash_authentication_oauth2_server0.3.1. The patch requires the ClientResource extension, adds a last_used_at attribute for garbage collection, and enforces a compile-time check via @after_verify {Oauth2Server, :__verify_cimd_support__!} so misconfigured deployments fail closed. See the GitHub commit 45e24f6 and the OSV entry EEF-CVE-2026-82753 for authoritative references.

Workarounds

Disable CIMD-based client registration until the upgrade is complete.
Restrict /authorize access at the network edge to known partners or IP ranges where feasible.
Apply an application-level filter that rejects URL-shaped client_id values not on an allowlist.

bash

# Update the dependency in mix.exs, then fetch and compile
# {:ash_authentication_oauth2_server, "~> 0.3.1"}
mix deps.update ash_authentication_oauth2_server
mix deps.get
mix compile