CVE-2026-65635
HighCVSS 8.3Summary
The Boruta library in Elixir has an improper isolation vulnerability allowing unauthenticated attackers to register OpenID Connect clients with administrative privileges. The lack of an allowlist lets attackers set sensitive attributes like grant types, scopes, PKCE enforcement, and token lifetimes.
Risk Assessment
An attacker can gain unauthorized administrative access to the authentication system, potentially leading to account takeover and data theft.
Recommendation
Immediately update the boruta library to version 2.3.7 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Boruta
See all- CVE-2026-54885Medium
An SSRF vulnerability in the Boruta library (versions 2.3.2 through 2.3.7) allows an unauthenticated attacker to force the OAuth/OpenID authorization server to send HTTP requests to arbitrary URIs, including internal services and cloud metadata endpoints. The vulnerability exists in three code paths that do not properly validate target URIs.
- CVE-2026-53431Critical
Authentication bypass by capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta does not enforce the exp claim check, allowing replay attacks.
- CVE-2026-55221Medium
Boruta, a standalone authorization server implementing OAuth 2.0 and OpenID Connect, prior to version 0.10.0 logged sensitive values in business event logs. These could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with log access could recover these credentials and use them until expiration or revocation.
- CVE-2026-49249High
Boruta before version 0.10.0 atomizes every key of the user-supplied request body via String.to_atom/1 before validation. Because String.to_atom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms), any authenticated user can exhaust the global VM atom table, causing the BEAM to abort and crash the entire OIDC server. Patched in version 0.10.0.
Original NVD description (English source)
Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval. This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta from 2.3.0 before 2.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS