# CVE-2026-65635: malach-it boruta privilege escalation in OpenID dynamic registration

Source: https://junglewise.ai/threats/cve-2026-65635-malach-it-boruta-privilege-escalation-in-openid-dynamic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-65635 · Severity: info · CVSS 8.3 · Published 2026-07-30

Boruta is an Elixir library used to implement OpenID Connect and OAuth2 authentication services. A security flaw in its dynamic client registration feature allows unauthenticated users to create new application clients with administrative-level permissions. This could allow an attacker to bypass security controls like PKCE, grant themselves unauthorized access scopes, or manipulate token lifetimes, potentially leading to unauthorized access to protected user data or services.

Technologies: [Malach-It Boruta](https://junglewise.ai/threats/technologies/boruta). Vendors: [Malach-It](https://junglewise.ai/threats/vendors/malach-it).

## Quick answers

**Is CVE-2026-65635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65635 being exploited in the wild.

**How severe is CVE-2026-65635?** Informational severity, with a CVSS score of 8.3, published 30 July 2026.

**Which products and versions are affected?** Malach-It Boruta 2.3.0 to 2.3.6.

**Is there a fix for CVE-2026-65635?** A patch was published on 2026-07-30: Fix released in version 2.3.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65635 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65635?** Check whether you run Malach-It Boruta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Boruta.Openid.register_client/3 function and parse_registration_params/2 routine. The library fails to implement a field-level allowlist when processing dynamic registration requests, forwarding all caller-supplied parameters directly to the administrative client creation path. An unauthenticated attacker can exploit this to set sensitive attributes such as authorized scopes, supported grant types, PKCE enforcement, and token lifetimes. The issue is fixed in version 2.3.7 by introducing a strict allowlist for public metadata. Exploitation requires the host application to have exposed the registration endpoint to untrusted networks without additional server-side filtering.

## Affected products

- malach-it boruta 2.3.0 to 2.3.6

## Timeline

- 2026-07-30: advisory: GHSA-w869-fcf2-68vp published
- 2026-07-30: disclosed: CVE-2026-65635 published
- 2026-07-30: patched: Fix released in version 2.3.7

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-65635.html](https://cna.erlef.org/cves/CVE-2026-65635.html)
- [https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643](https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643)
- [https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525](https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525)
- [https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp](https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp)

## Related threats

- [Boruta authorization server sensitive token logging](https://junglewise.ai/threats/cve-2026-55221-boruta-authorization-server-sensitive-token-logging)
- [malach-it Boruta SSRF in OAuth and OpenID URI fetching](https://junglewise.ai/threats/cve-2026-54885-malach-it-boruta-ssrf-in-oauth-and-openid-uri-fetching)
- [malach-it Boruta authentication bypass via JWT replay](https://junglewise.ai/threats/cve-2026-53431-malach-it-boruta-authentication-bypass-via-jwt-replay)