The vulnerability arises from improper isolation or compartmentalization in the Boruta.Openid.register_client/3 function, which forwards caller-supplied registration parameters directly to the administrative client creation path without enforcing a field-level allowlist separating public and administrative metadata. As a result, unauthenticated registrants can configure security-sensitive client attributes that should require operator approval. This affects boruta versions from 2.3.0 before 2.3.7 and involves the program files lib/boruta/openid.ex and routines register_client/3 and parse_registration_params/2.

An attacker can register OpenID Connect clients with administrative privileges without authentication, potentially manipulating grant types, authorized scopes, PKCE enforcement, token lifetimes, and signing settings. This could lead to unauthorized access, privilege escalation, and compromise of the authentication system relying on boruta for OpenID Connect client management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the dynamic client registration endpoint if possible and monitor for unauthorized client registrations. Review and implement strict validation and allowlisting of client registration parameters to separate public and administrative metadata.