Search
Find a vulnerability
Search criteria
6 vulnerabilities found for boruta by malach-it
CVE-2026-65635 (GCVE-0-2026-65635)
Vulnerability from nvd – Published: 2026-07-30 14:17 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Boruta dynamic client registration allows creation of over-privileged OAuth clients
Summary
Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.
This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2.
This issue affects boruta from 2.3.0 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-653 - Improper Isolation or Compartmentalization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-65635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-65635 | related |
| https://github.com/malach-it/boruta_auth/commit/8… | patch |
| https://github.com/malach-it/boruta_auth/commit/9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:13:41.629153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:13:59.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Boruta.Openid"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/openid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Openid\u0027:register_client/3"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Boruta.Openid"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/openid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Openid\u0027:register_client/3"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "82584c854a332482232fd25301ab12a835f9f643",
"status": "unaffected"
},
{
"at": "95619a1beaff68fa766cca9b388e7c780d182525",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "85481b706636fe68a43d0b8d3275e2afc7f7fee1",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA deployment is vulnerable when the host application exposes \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e from a public endpoint are not exploitable.\u003c/p\u003e"
}
],
"value": "A deployment is vulnerable when the host application exposes Boruta.Openid.register_client/3 on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call Boruta.Openid.register_client/3 from a public endpoint are not exploitable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Isolation or Compartmentalization vulnerability in malach-it boruta (\u003ctt\u003eElixir.Boruta.Openid\u003c/tt\u003e module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/boruta/openid.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:register_client/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects boruta from 2.3.0 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.\n\nThis vulnerability is associated with program files lib/boruta/openid.ex and program routines \u0027Elixir.Boruta.Openid\u0027:register_client/3, \u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2.\n\nThis issue affects boruta from 2.3.0 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653 Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:15.914Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65635.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65635"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Boruta dynamic client registration allows creation of over-privileged OAuth clients",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function.\u003c/p\u003e"
}
],
"value": "Disable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to Boruta.Openid.register_client/3 directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65635",
"datePublished": "2026-07-30T14:17:02.942Z",
"dateReserved": "2026-07-22T13:58:26.233Z",
"dateUpdated": "2026-07-31T04:20:15.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54885 (GCVE-0-2026-54885)
Vulnerability from nvd – Published: 2026-07-30 14:16 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Summary
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.
Three code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |> Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server's HTTP client at arbitrary network targets reachable from the Boruta host.
This issue affects boruta: from 2.3.2 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-54885.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-54885 | related |
| https://github.com/malach-it/boruta_auth/commit/0… | patch |
| https://github.com/malach-it/boruta_auth/commit/9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54885",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:14:18.216537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:14:32.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Openid\u0027",
"\u0027Elixir.Boruta.Ecto.Clients\u0027"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/openid.ex",
"lib/boruta/adapters/ecto/clients.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
},
{
"name": "\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Openid\u0027",
"\u0027Elixir.Boruta.Ecto.Clients\u0027"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/openid.ex",
"lib/boruta/adapters/ecto/clients.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
},
{
"name": "\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "001e3dc5c259e67c6f907e98867eda4141c96d0d",
"status": "unaffected"
},
{
"at": "95fb10b78129355e475681f324c9a01ef0af2be5",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "15455b86206e0370eabd64c1856a5c996b436455",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.\u003c/p\u003e\u003cp\u003eThree code paths fetch remote URIs supplied by the requester without sufficient validation of the target. \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/request/base.ex\u003c/tt\u003e dereferences the OAuth \u003ctt\u003erequest_uri\u003c/tt\u003e parameter from the authorization request via \u003ctt\u003eFinch.build(:get, request_uri) |\u0026gt; Finch.request(OpenIDHttpClient)\u003c/tt\u003e. \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2\u003c/tt\u003e in \u003ctt\u003elib/boruta/openid.ex\u003c/tt\u003e dereferences the \u003ctt\u003ejwks_uri\u003c/tt\u003e supplied in an OpenID Connect dynamic client registration request. \u003ctt\u003e\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/adapters/ecto/clients.ex\u003c/tt\u003e later refreshes the stored \u003ctt\u003ejwks_uri\u003c/tt\u003e for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two \u003ctt\u003erequest_uri\u003c/tt\u003e clauses does not even restrict the scheme to \u003ctt\u003ehttp\u003c/tt\u003e or \u003ctt\u003ehttps\u003c/tt\u003e). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server\u0027s HTTP client at arbitrary network targets reachable from the Boruta host.\u003c/p\u003e\u003cp\u003eThis issue affects boruta: from 2.3.2 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.\n\nThree code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |\u003e Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server\u0027s HTTP client at arbitrary network targets reachable from the Boruta host.\n\nThis issue affects boruta: from 2.3.2 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:03.434Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-54885.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54885"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/001e3dc5c259e67c6f907e98867eda4141c96d0d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/95fb10b78129355e475681f324c9a01ef0af2be5"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the network egress of the Boruta host so that the OAuth/OpenID authorization server cannot reach loopback, private, link-local, multicast, or cloud metadata addresses. Where possible, disable application routes for OAuth \u003ctt\u003erequest_uri\u003c/tt\u003e dereferencing and OpenID Connect dynamic client registration, or restrict OpenID Connect dynamic client registration to trusted callers, until a patched release is deployed.\u003c/p\u003e"
}
],
"value": "Restrict the network egress of the Boruta host so that the OAuth/OpenID authorization server cannot reach loopback, private, link-local, multicast, or cloud metadata addresses. Where possible, disable application routes for OAuth request_uri dereferencing and OpenID Connect dynamic client registration, or restrict OpenID Connect dynamic client registration to trusted callers, until a patched release is deployed."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-54885",
"datePublished": "2026-07-30T14:16:43.631Z",
"dateReserved": "2026-06-16T10:47:13.914Z",
"dateUpdated": "2026-07-31T04:20:03.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53431 (GCVE-0-2026-53431)
Vulnerability from nvd – Published: 2026-07-30 14:17 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Boruta accepts expired JWT client assertions due to missing exp claim validation
Summary
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.
Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client's privileges.
This issue affects boruta: from 2.3.0 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-53431.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-53431 | related |
| https://github.com/malach-it/boruta_auth/commit/5… | patch |
| https://github.com/malach-it/boruta_auth/commit/6… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53431",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:12:55.290055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:13:22.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/oauth/authorization/client.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_client_authentication/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/oauth/authorization/client.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_client_authentication/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "5204f88f9b2cdd9637a755337ed5f99185be5474",
"status": "unaffected"
},
{
"at": "69363432aa36760fc5438e4e17115d0f7c1b925a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "5bfbe1c5443bffe71cf1bf954bbdff61327d9a83",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe attack requires that the Boruta deployment has provisioned at least one OAuth client configured to authenticate via JWT client assertions (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e or \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e token endpoint authentication methods). Deployments that authenticate clients only via \u003ctt\u003eclient_secret_basic\u003c/tt\u003e or \u003ctt\u003eclient_secret_post\u003c/tt\u003e are not exposed.\u003c/p\u003e"
}
],
"value": "The attack requires that the Boruta deployment has provisioned at least one OAuth client configured to authenticate via JWT client assertions (client_secret_jwt or private_key_jwt token endpoint authentication methods). Deployments that authenticate clients only via client_secret_basic or client_secret_post are not exposed."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.\u003c/p\u003e\u003cp\u003eBoruta accepts JWT-based client authentication (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e and \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e token endpoint authentication methods) but never enforces that the assertion\u0027s \u003ctt\u003eexp\u003c/tt\u003e claim is in the future. The pre-check helper \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/request/base.ex\u003c/tt\u003e only verifies that an \u003ctt\u003eexp\u003c/tt\u003e claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/authorization/client.ex\u003c/tt\u003e, returns an empty map, so Joken\u0027s default \u003ctt\u003eexp\u003c/tt\u003e claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client\u0027s privileges.\u003c/p\u003e\u003cp\u003eThis issue affects boruta: from 2.3.0 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.\n\nBoruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion\u0027s exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken\u0027s default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client\u0027s privileges.\n\nThis issue affects boruta: from 2.3.0 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:43.209Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-53431.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53431"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Boruta accepts expired JWT client assertions due to missing exp claim validation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the use of JWT-based client authentication (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e and \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e) to highly trusted clients, and prefer non-JWT client authentication methods (\u003ctt\u003eclient_secret_basic\u003c/tt\u003e or \u003ctt\u003eclient_secret_post\u003c/tt\u003e) where possible. Where JWT client authentication must remain enabled, issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay.\u003c/p\u003e"
}
],
"value": "Restrict the use of JWT-based client authentication (client_secret_jwt and private_key_jwt) to highly trusted clients, and prefer non-JWT client authentication methods (client_secret_basic or client_secret_post) where possible. Where JWT client authentication must remain enabled, issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-53431",
"datePublished": "2026-07-30T14:17:27.909Z",
"dateReserved": "2026-06-09T11:01:47.529Z",
"dateUpdated": "2026-07-31T04:20:43.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53431 (GCVE-0-2026-53431)
Vulnerability from cvelistv5 – Published: 2026-07-30 14:17 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Boruta accepts expired JWT client assertions due to missing exp claim validation
Summary
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.
Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client's privileges.
This issue affects boruta: from 2.3.0 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-53431.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-53431 | related |
| https://github.com/malach-it/boruta_auth/commit/5… | patch |
| https://github.com/malach-it/boruta_auth/commit/6… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53431",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:12:55.290055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:13:22.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/oauth/authorization/client.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_client_authentication/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/oauth/authorization/client.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_client_authentication/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "5204f88f9b2cdd9637a755337ed5f99185be5474",
"status": "unaffected"
},
{
"at": "69363432aa36760fc5438e4e17115d0f7c1b925a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "5bfbe1c5443bffe71cf1bf954bbdff61327d9a83",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe attack requires that the Boruta deployment has provisioned at least one OAuth client configured to authenticate via JWT client assertions (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e or \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e token endpoint authentication methods). Deployments that authenticate clients only via \u003ctt\u003eclient_secret_basic\u003c/tt\u003e or \u003ctt\u003eclient_secret_post\u003c/tt\u003e are not exposed.\u003c/p\u003e"
}
],
"value": "The attack requires that the Boruta deployment has provisioned at least one OAuth client configured to authenticate via JWT client assertions (client_secret_jwt or private_key_jwt token endpoint authentication methods). Deployments that authenticate clients only via client_secret_basic or client_secret_post are not exposed."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.\u003c/p\u003e\u003cp\u003eBoruta accepts JWT-based client authentication (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e and \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e token endpoint authentication methods) but never enforces that the assertion\u0027s \u003ctt\u003eexp\u003c/tt\u003e claim is in the future. The pre-check helper \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/request/base.ex\u003c/tt\u003e only verifies that an \u003ctt\u003eexp\u003c/tt\u003e claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/authorization/client.ex\u003c/tt\u003e, returns an empty map, so Joken\u0027s default \u003ctt\u003eexp\u003c/tt\u003e claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client\u0027s privileges.\u003c/p\u003e\u003cp\u003eThis issue affects boruta: from 2.3.0 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.\n\nBoruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion\u0027s exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken\u0027s default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client\u0027s privileges.\n\nThis issue affects boruta: from 2.3.0 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:43.209Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-53431.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53431"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Boruta accepts expired JWT client assertions due to missing exp claim validation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the use of JWT-based client authentication (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e and \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e) to highly trusted clients, and prefer non-JWT client authentication methods (\u003ctt\u003eclient_secret_basic\u003c/tt\u003e or \u003ctt\u003eclient_secret_post\u003c/tt\u003e) where possible. Where JWT client authentication must remain enabled, issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay.\u003c/p\u003e"
}
],
"value": "Restrict the use of JWT-based client authentication (client_secret_jwt and private_key_jwt) to highly trusted clients, and prefer non-JWT client authentication methods (client_secret_basic or client_secret_post) where possible. Where JWT client authentication must remain enabled, issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-53431",
"datePublished": "2026-07-30T14:17:27.909Z",
"dateReserved": "2026-06-09T11:01:47.529Z",
"dateUpdated": "2026-07-31T04:20:43.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65635 (GCVE-0-2026-65635)
Vulnerability from cvelistv5 – Published: 2026-07-30 14:17 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Boruta dynamic client registration allows creation of over-privileged OAuth clients
Summary
Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.
This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2.
This issue affects boruta from 2.3.0 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-653 - Improper Isolation or Compartmentalization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-65635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-65635 | related |
| https://github.com/malach-it/boruta_auth/commit/8… | patch |
| https://github.com/malach-it/boruta_auth/commit/9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:13:41.629153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:13:59.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Boruta.Openid"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/openid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Openid\u0027:register_client/3"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Boruta.Openid"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/openid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Openid\u0027:register_client/3"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "82584c854a332482232fd25301ab12a835f9f643",
"status": "unaffected"
},
{
"at": "95619a1beaff68fa766cca9b388e7c780d182525",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "85481b706636fe68a43d0b8d3275e2afc7f7fee1",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA deployment is vulnerable when the host application exposes \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e from a public endpoint are not exploitable.\u003c/p\u003e"
}
],
"value": "A deployment is vulnerable when the host application exposes Boruta.Openid.register_client/3 on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call Boruta.Openid.register_client/3 from a public endpoint are not exploitable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Isolation or Compartmentalization vulnerability in malach-it boruta (\u003ctt\u003eElixir.Boruta.Openid\u003c/tt\u003e module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/boruta/openid.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:register_client/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects boruta from 2.3.0 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.\n\nThis vulnerability is associated with program files lib/boruta/openid.ex and program routines \u0027Elixir.Boruta.Openid\u0027:register_client/3, \u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2.\n\nThis issue affects boruta from 2.3.0 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653 Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:15.914Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65635.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65635"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Boruta dynamic client registration allows creation of over-privileged OAuth clients",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function.\u003c/p\u003e"
}
],
"value": "Disable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to Boruta.Openid.register_client/3 directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65635",
"datePublished": "2026-07-30T14:17:02.942Z",
"dateReserved": "2026-07-22T13:58:26.233Z",
"dateUpdated": "2026-07-31T04:20:15.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54885 (GCVE-0-2026-54885)
Vulnerability from cvelistv5 – Published: 2026-07-30 14:16 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Summary
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.
Three code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |> Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server's HTTP client at arbitrary network targets reachable from the Boruta host.
This issue affects boruta: from 2.3.2 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-54885.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-54885 | related |
| https://github.com/malach-it/boruta_auth/commit/0… | patch |
| https://github.com/malach-it/boruta_auth/commit/9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54885",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:14:18.216537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:14:32.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Openid\u0027",
"\u0027Elixir.Boruta.Ecto.Clients\u0027"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/openid.ex",
"lib/boruta/adapters/ecto/clients.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
},
{
"name": "\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Openid\u0027",
"\u0027Elixir.Boruta.Ecto.Clients\u0027"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/openid.ex",
"lib/boruta/adapters/ecto/clients.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
},
{
"name": "\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "001e3dc5c259e67c6f907e98867eda4141c96d0d",
"status": "unaffected"
},
{
"at": "95fb10b78129355e475681f324c9a01ef0af2be5",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "15455b86206e0370eabd64c1856a5c996b436455",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.\u003c/p\u003e\u003cp\u003eThree code paths fetch remote URIs supplied by the requester without sufficient validation of the target. \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/request/base.ex\u003c/tt\u003e dereferences the OAuth \u003ctt\u003erequest_uri\u003c/tt\u003e parameter from the authorization request via \u003ctt\u003eFinch.build(:get, request_uri) |\u0026gt; Finch.request(OpenIDHttpClient)\u003c/tt\u003e. \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2\u003c/tt\u003e in \u003ctt\u003elib/boruta/openid.ex\u003c/tt\u003e dereferences the \u003ctt\u003ejwks_uri\u003c/tt\u003e supplied in an OpenID Connect dynamic client registration request. \u003ctt\u003e\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/adapters/ecto/clients.ex\u003c/tt\u003e later refreshes the stored \u003ctt\u003ejwks_uri\u003c/tt\u003e for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two \u003ctt\u003erequest_uri\u003c/tt\u003e clauses does not even restrict the scheme to \u003ctt\u003ehttp\u003c/tt\u003e or \u003ctt\u003ehttps\u003c/tt\u003e). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server\u0027s HTTP client at arbitrary network targets reachable from the Boruta host.\u003c/p\u003e\u003cp\u003eThis issue affects boruta: from 2.3.2 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.\n\nThree code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |\u003e Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server\u0027s HTTP client at arbitrary network targets reachable from the Boruta host.\n\nThis issue affects boruta: from 2.3.2 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:03.434Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-54885.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54885"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/001e3dc5c259e67c6f907e98867eda4141c96d0d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/95fb10b78129355e475681f324c9a01ef0af2be5"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the network egress of the Boruta host so that the OAuth/OpenID authorization server cannot reach loopback, private, link-local, multicast, or cloud metadata addresses. Where possible, disable application routes for OAuth \u003ctt\u003erequest_uri\u003c/tt\u003e dereferencing and OpenID Connect dynamic client registration, or restrict OpenID Connect dynamic client registration to trusted callers, until a patched release is deployed.\u003c/p\u003e"
}
],
"value": "Restrict the network egress of the Boruta host so that the OAuth/OpenID authorization server cannot reach loopback, private, link-local, multicast, or cloud metadata addresses. Where possible, disable application routes for OAuth request_uri dereferencing and OpenID Connect dynamic client registration, or restrict OpenID Connect dynamic client registration to trusted callers, until a patched release is deployed."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-54885",
"datePublished": "2026-07-30T14:16:43.631Z",
"dateReserved": "2026-06-16T10:47:13.914Z",
"dateUpdated": "2026-07-31T04:20:03.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}