Executive brief
Boruta is an OAuth 2.0 and OpenID Connect authorization server used for managing user authentication and delegated access. Prior to version 0.10.0, the system logged sensitive security tokens (access tokens, refresh tokens, authorization codes, ID tokens, and others) in business event logs, exposing them to anyone with access to logs or log aggregation systems. An attacker could recover these tokens and impersonate users or applications until the tokens expired or were revoked.
Technical details
The vulnerability is a sensitive information disclosure bug in the logging layer of Boruta's OAuth and OpenID Connect implementation. The vulnerable component logged business events containing plaintext OAuth credentials including access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens submitted to introspection or revocation endpoints. Attack preconditions include having access to Boruta instance logs, centralized log aggregation systems, or the administration log viewer interface. An attacker with log access can extract these credentials and use them for token-based authentication until expiration or revocation. The vulnerability was patched in version 0.10.0 by redacting OAuth credentials from logged events; a security commit on 2026-05-30 demonstrates credential redaction in the logging implementation.
Affected products
- malach-it Boruta before 0.10.0
Timeline
- 2026-09-02: disclosed
- 0.10.0: patched: released 2026-06-12