ash_authentication_oauth2_server
An Oauth2 server for Ash Framework applications using AshAuthentication
View on Github
Activity
- Latest release
- 6d ago
- Total releases
- 9
- Cadence
- ~daily
- Last 12 months
- 9
Reach
- Downloads
- 20.9k
- Stars
- 9
Details
- License
- MIT
- First release
- May 25, 2026
| Version | Released | |
|---|---|---|
0.3.1
patch
|
0.3.1
patch
Dependencies (8)
Changelog
Compare changes
|
|
0.3.0
minor
6 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82757
EEF-CVE-2026-82757
GHSA-wprp-8gvj-p6cv
Sep 07, 2026
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Low
Network
Low
None
None
SummaryServer-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1. ConfigurationsReachable only when Client ID Metadata Documents are enabled ( Affected versions
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82756
EEF-CVE-2026-82756
GHSA-2h3v-83jg-2qmm
Sep 07, 2026
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Medium
Network
Low
None
None
SummaryImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82755
EEF-CVE-2026-82755
GHSA-crqf-7m54-4hgc
Sep 07, 2026
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Medium
Network
Low
None
None
SummaryUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82753
EEF-CVE-2026-82753
GHSA-9pv3-wxjm-f846
Sep 07, 2026
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
High
Network
Low
None
None
SummaryAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory. The This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1. ConfigurationsReachable only when the client resource has Client ID Metadata Documents enabled ( Affected versions
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev |
0.3.0
minor
Dependencies (8)
Changelog
Compare changes
|
|
0.2.2
patch
4 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82756
EEF-CVE-2026-82756
GHSA-2h3v-83jg-2qmm
Sep 07, 2026
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Medium
Network
Low
None
None
SummaryImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82755
EEF-CVE-2026-82755
GHSA-crqf-7m54-4hgc
Sep 07, 2026
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Medium
Network
Low
None
None
SummaryUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev | ||
0.2.1
patch
4 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82756
EEF-CVE-2026-82756
GHSA-2h3v-83jg-2qmm
Sep 07, 2026
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Medium
Network
Low
None
None
SummaryImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82755
EEF-CVE-2026-82755
GHSA-crqf-7m54-4hgc
Sep 07, 2026
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Medium
Network
Low
None
None
SummaryUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev | ||
0.2.0
minor
4 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82756
EEF-CVE-2026-82756
GHSA-2h3v-83jg-2qmm
Sep 07, 2026
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Medium
Network
Low
None
None
SummaryImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82755
EEF-CVE-2026-82755
GHSA-crqf-7m54-4hgc
Sep 07, 2026
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Medium
Network
Low
None
None
SummaryUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev | ||
0.1.3
patch
4 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82756
EEF-CVE-2026-82756
GHSA-2h3v-83jg-2qmm
Sep 07, 2026
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Medium
Network
Low
None
None
SummaryImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82755
EEF-CVE-2026-82755
GHSA-crqf-7m54-4hgc
Sep 07, 2026
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Medium
Network
Low
None
None
SummaryUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1. ConfigurationsReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Affected versions
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev | ||
0.1.2
patch
2 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev | ||
0.1.1
patch
2 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev | ||
0.1.0
initial
2 CVEs
CVE-2026-82758
EEF-CVE-2026-82758
GHSA-fxc6-vp68-87pw
Sep 07, 2026
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Medium
Network
Low
None
None
SummaryImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsReachable only when the server configures an Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev
CVE-2026-82754
EEF-CVE-2026-82754
GHSA-wwxg-h779-3wf4
Sep 07, 2026
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Medium
Network
Low
None
None
SummaryImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1. ConfigurationsThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
Fixed in
0.3.1
References
Updated Sep 08, 2026 · Source: OSV.dev |