Executive brief
Boruta is an Elixir library used to implement OpenID Connect and OAuth2 authentication services. A security flaw in its dynamic client registration feature allows unauthenticated users to create new application clients with administrative-level permissions. This could allow an attacker to bypass security controls like PKCE, grant themselves unauthorized access scopes, or manipulate token lifetimes, potentially leading to unauthorized access to protected user data or services.
Technical details
The vulnerability exists in the Boruta.Openid.register_client/3 function and parse_registration_params/2 routine. The library fails to implement a field-level allowlist when processing dynamic registration requests, forwarding all caller-supplied parameters directly to the administrative client creation path. An unauthenticated attacker can exploit this to set sensitive attributes such as authorized scopes, supported grant types, PKCE enforcement, and token lifetimes. The issue is fixed in version 2.3.7 by introducing a strict allowlist for public metadata. Exploitation requires the host application to have exposed the registration endpoint to untrusted networks without additional server-side filtering.
Affected products
- malach-it boruta 2.3.0 to 2.3.6
Timeline
- 2026-07-30: advisory: GHSA-w869-fcf2-68vp published
- 2026-07-30: disclosed: CVE-2026-65635 published
- 2026-07-30: patched: Fix released in version 2.3.7
References
- https://repo.hex.pm/
- https://github.com/
- https://cna.erlef.org/cves/CVE-2026-65635.html
- https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643
- https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525
- https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp