PT-2026-66491 · Boruta · Boruta
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
boruta versions 2.3.0 through 2.3.6
Description
An authentication bypass exists allowing an attacker to authenticate as an OAuth client using a previously valid but expired JWT client assertion. The software accepts
client secret jwt and private key jwt authentication methods at the token endpoint but fails to verify that the exp claim is in the future. Specifically, the check expiration/1 function in Boruta.Oauth.Request.Base only checks for the presence of the exp claim, and the token config/0 function in Boruta.Oauth.Authorization.Client.Token returns an empty map, bypassing the default expiration validator. An attacker who obtains a signed client assertion through logs or proxies can replay it indefinitely to obtain access tokens with the client's privileges.Recommendations
Update boruta to version 2.3.7 or later.
Restrict the use of
client secret jwt and private key jwt authentication to highly trusted clients.
Prefer non-JWT authentication methods such as client secret basic or client secret post.
Issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Boruta