Threat Intelligence Database

CVE-2026-65635 is a high-severity vulnerability in the malach-it boruta library (Elixir.Boruta.Openid module) that allows unauthenticated attackers to register OpenID Connect clients with administrative privileges. This occurs because the dynamic client registration endpoint does not properly isolate administrative controls from public client metadata, enabling attackers to set sensitive attributes such as grant types, scopes, token lifetimes, and signing settings. The issue affects boruta versions 2.3.0 up to but not including 2.3.7.

CVE-2026-54885 is a Server-Side Request Forgery (SSRF) vulnerability in malach-it Boruta versions 2.3.2 up to but not including 2.3.7. It allows unauthenticated remote attackers to make the OAuth/OpenID authorization server issue HTTP requests to arbitrary URIs, including internal services and cloud metadata endpoints. The vulnerability arises from insufficient validation of user-supplied URIs in multiple code paths, lacking restrictions on schemes, host/IP allowlists, and response constraints.

CVE-2026-53431 is an authentication bypass vulnerability in malach-it Boruta versions 2.3.0 up to but not including 2.3.7. The flaw allows an attacker who has obtained a previously valid JWT client assertion to reuse it after expiration to authenticate as the legitimate OAuth client. This occurs because Boruta does not properly enforce the expiration (exp) claim in JWT assertions, allowing indefinite replay. The vulnerability has a critical severity with a CVSS score of 9.1.