Skip to content
OpenAdvisories

Package · Hex

boruta

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-53431

    Boruta accepts expired JWT client assertions due to missing exp claim validation

    Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client …

    malach-it boruta boruta Hex