PT-2026-66494 · Boruta · Boruta
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
boruta versions 2.3.0 through 2.3.6
Description
Improper Isolation or Compartmentalization in the
Elixir.Boruta.Openid module allows unauthenticated attackers to register OpenID Connect clients with administrative privileges via the dynamic client registration entry point. The function register client/3 forwards caller-supplied parameters to the administrative client creation path without a field-level allowlist. This enables attackers to set security-sensitive attributes, such as supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The issue is also associated with the parse registration params/2 function. The flaw exists because the library fails to distinguish between metadata a public registrant can set and administrative controls requiring operator approval.Recommendations
Update boruta to version 2.3.7.
Disable the dynamic client registration route or restrict it to authenticated administrators.
If dynamic registration must remain available to untrusted callers, avoid forwarding request parameters to
register client/3 directly; instead, construct a parameter map containing only standards-defined public metadata and overwrite administrative attributes with fixed least-privilege server-side profile values before calling the function.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Boruta