Skip to content
OpenAdvisories

Vendor

malach-it

6 known vulnerabilities.

Products

boruta-server 3 boruta 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-49249

    Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2

    Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied req…

    malach-it boruta-server
  • High 8.3
    CVE-2026-65635

    Boruta dynamic client registration allows creation of over-privileged OAuth clients

    Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.re…

    malach-it boruta boruta Hex
  • High 8.8
    CVE-2026-53661

    boruta-server sent sensitive session cookies without the Secure attribute

    Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set without the Secure attri…

    malach-it boruta-server