PT-2026-66494 · Boruta · Boruta

·

CVE-2026-65635

·

Published

2026-07-30

·

Updated

2026-07-30

CVSS v4.0

8.3

High

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N
Name of the Vulnerable Software and Affected Versions boruta versions 2.3.0 through 2.3.6
Description Improper Isolation or Compartmentalization in the Elixir.Boruta.Openid module allows unauthenticated attackers to register OpenID Connect clients with administrative privileges via the dynamic client registration entry point. The function register client/3 forwards caller-supplied parameters to the administrative client creation path without a field-level allowlist. This enables attackers to set security-sensitive attributes, such as supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The issue is also associated with the parse registration params/2 function. The flaw exists because the library fails to distinguish between metadata a public registrant can set and administrative controls requiring operator approval.
Recommendations Update boruta to version 2.3.7. Disable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, avoid forwarding request parameters to register client/3 directly; instead, construct a parameter map containing only standards-defined public metadata and overwrite administrative attributes with fixed least-privilege server-side profile values before calling the function.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-65635
GHSA-W869-FCF2-68VP

Affected Products

Boruta