Skip to content
OpenAdvisories

Vendor

malach-it

6 known vulnerabilities.

Products

boruta-server 3 boruta 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-55221

    Boruta: OAuth credentials exposed in Boruta business logs

    Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values…

    malach-it boruta-server
  • Medium 6.9
    CVE-2026-54885

    Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

    Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endp…

    malach-it boruta boruta Hex