An unauthenticated resource exhaustion vulnerability in ash_authentication_oauth2_server poses a high risk of service denial by allowing attackers to overwhelm database and memory resources.

This is an allocation of resources without limits or throttling (CWE-770) issue within the resolve_client/3 function. Unauthenticated attackers can trigger the storage of unbounded, unvalidated metadata documents by providing distinct URL-based client IDs, leading to uncontrolled memory and storage growth.

The vulnerability carries a CVSS score of 8.2, classifying it as high severity. Successful exploitation could lead to a complete denial of service for the authentication server, preventing legitimate users from accessing protected resources and potentially causing cascading failures in dependent systems due to resource exhaustion.

Immediate Action: Upgrade to version 0.3.1 or later to implement necessary caching limits and validation constraints for client metadata documents.

Proactive Monitoring: Monitor server memory usage and database storage growth patterns for anomalous spikes that correlate with incoming /authorize requests.

Compensating Controls: Deploy a Web Application Firewall or rate-limiting proxy to restrict the frequency of requests to the /authorize endpoint from individual sources while a patch is being scheduled.

Public Exploit Available: Unknown

Given the potential for significant service disruption, organizations running versions of ash_authentication_oauth2_server prior to 0.3.1 should prioritize an immediate update to the patched version. Implementing strict resource constraints is essential to preventing this denial of service vector and ensuring the continued availability of authentication services.