# CVE-2026-53431: malach-it Boruta authentication bypass via JWT replay

Source: https://junglewise.ai/threats/cve-2026-53431-malach-it-boruta-authentication-bypass-via-jwt-replay  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-53431 · Severity: info · CVSS 9.1 · Published 2026-07-30

Boruta, an Elixir-based OAuth 2.0 and OpenID Connect provider, fails to check the expiration date of security tokens used for client authentication. This allows an attacker who intercepts an old, expired login token to reuse it indefinitely to impersonate a legitimate client application. Successful exploitation could lead to unauthorized access to sensitive data or the ability to perform actions on behalf of the compromised application.

Technologies: [Malach-It Boruta](https://junglewise.ai/threats/technologies/boruta). Vendors: [Malach-It](https://junglewise.ai/threats/vendors/malach-it).

## Quick answers

**Is CVE-2026-53431 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53431 being exploited in the wild.

**How severe is CVE-2026-53431?** Informational severity, with a CVSS score of 9.1, published 30 July 2026.

**Which products and versions are affected?** Malach-It Boruta from 2.3.0 before 2.3.7.

**Is there a fix for CVE-2026-53431?** A patch was published on 2026-07-30: Fixes merged in commits 5204f88 and 6936343 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53431 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53431?** Check whether you run Malach-It Boruta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass by capture-replay exists in Boruta due to missing expiration validation for JWT-based client authentication (client_secret_jwt and private_key_jwt). The vulnerable component, Boruta.Oauth.Request.Base.check_expiration/1, only verifies the presence of the 'exp' claim without checking if the timestamp is in the future. Additionally, the Joken configuration in Boruta.Oauth.Authorization.Client.Token.token_config/0 returns an empty map, bypassing default library-level validation. A remote attacker who obtains a previously valid JWT assertion (e.g., from logs or proxies) can replay it to authenticate as the OAuth client and obtain access tokens. The issue is fixed in version 2.3.7.

## Affected products

- malach-it boruta from 2.3.0 before 2.3.7

## Timeline

- 2026-07-30: advisory: Original advisory published by EEF CNA
- 2026-07-30: patched: Fixes merged in commits 5204f88 and 6936343

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-53431.html](https://cna.erlef.org/cves/CVE-2026-53431.html)
- [https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474](https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474)
- [https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a](https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a)
- [https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6](https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6)

## Related threats

- [Boruta authorization server sensitive token logging](https://junglewise.ai/threats/cve-2026-55221-boruta-authorization-server-sensitive-token-logging)
- [malach-it boruta privilege escalation in OpenID dynamic registration](https://junglewise.ai/threats/cve-2026-65635-malach-it-boruta-privilege-escalation-in-openid-dynamic)
- [malach-it Boruta SSRF in OAuth and OpenID URI fetching](https://junglewise.ai/threats/cve-2026-54885-malach-it-boruta-ssrf-in-oauth-and-openid-uri-fetching)