CVE-2026-82753

CVE-2026-82753 is an unauthenticated denial-of-service flaw (CWE-770, allocation without limits) in the ash_authentication_oauth2_server Elixir package. When Client ID Metadata Documents (CIMD) are enabled, any unauthenticated request to the /authorize endpoint with a new URL-shaped client_id causes the server to fetch and permanently store a client row, with no cap on row count, no expiry or garbage collection, and no bound on field lengths; rejected documents were also cached before validation, holding memory until TTL expiry. An attacker can therefore drive unbounded growth of database storage and memory by supplying valid documents at many distinct URLs, eventually exhausting resources and taking the service down. Affected users are operators of Elixir/Ash applications running the oauth2_server extension in versions 0.3.0 up to (but not including) 0.3.1 with CIMD enabled. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at a low 0.4%.

What to do: Upgrade ash_authentication_oauth2_server to 0.3.1 or later. As interim mitigation, disable CIMD support or restrict which URLs are accepted as client_ids, and monitor database client-row growth and cache memory on internet-exposed /authorize endpoints. Verify in application configuration whether the OAuth2 server extension and CIMD are actually enabled, since deployments without CIMD are not exposed through this path.