Ash-project Ash Authentication Oauth2 Server vulnerabilities

• ash-project ash authentication oauth2 server ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint CVE-2026-82758 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF CVE-2026-82757 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection CVE-2026-82756 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion CVE-2026-82755 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls CVE-2026-82754 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server CVE-2026-82753 Fix available 8.2 HighSeptember 7, 2026