Skip to content
OpenAdvisories

Package · Hex

boruta

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.1
    CVE-2026-53431

    Boruta accepts expired JWT client assertions due to missing exp claim validation

    Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client …

    malach-it boruta boruta Hex
  • High 8.3
    CVE-2026-65635

    Boruta dynamic client registration allows creation of over-privileged OAuth clients

    Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.re…

    malach-it boruta boruta Hex
  • Medium 6.9
    CVE-2026-54885

    Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

    Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endp…

    malach-it boruta boruta Hex