CVE-2026-53431

Deferred Deferred - Pending Action

Authentication Bypass via JWT Replay in Boruta

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: EEF

Description

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client's privileges. This issue affects boruta: from 2.3.0 before 2.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-53431

EUVD

EUVD-2026-51145

Affected Vendors & Products

Vendor	Product	Version / Range
malach-it	boruta	From 2.3.0 (inc) to 2.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability is an Authentication Bypass by Capture-replay in malach-it Boruta. It allows an attacker who has a previously valid JWT client assertion to authenticate as the OAuth client even after the assertion has expired. The issue occurs because Boruta does not properly verify that the JWT's expiration claim (exp) is in the future, enabling indefinite replay of valid assertions.

Detection Guidance

To detect this vulnerability, inspect logs and network traffic for repeated JWT client assertions. Check for JWT tokens with expired exp claims being reused. Monitor OAuth token endpoint requests for client_secret_jwt or private_key_jwt authentication methods. Verify if Boruta versions between 2.3.0 and 2.3.6 are in use.

Impact Analysis

An attacker could gain unauthorized access to the system by replaying a valid but expired JWT client assertion. This could allow them to obtain access tokens with the privileges of the compromised OAuth client, potentially leading to data breaches, unauthorized actions, or further exploitation within the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The lack of proper JWT expiration enforcement may result in non-compliance with access control and audit logging mandates.

Mitigation Strategies

Upgrade Boruta to version 2.3.7 or later to address the authentication bypass issue. Review and restrict access to logs and observability surfaces where JWT client assertions might be exposed. Monitor authentication logs for unusual replay attempts.

Hi! I’m here to help you understand CVE-2026-53431. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70