CVE-2026-82756

ash_authentication_oauth2_server (ash-project) is vulnerable to header parameter injection in its BearerPlug and RequireScopePlug. A tenant-derived resource_metadata URL is interpolated directly into the WWW-Authenticate challenge without escaping, allowing an unauthenticated attacker in a multi-...