CVE-2026-65635

Deferred Deferred - Pending Action

Improper Isolation in Boruta OpenID Connect Client Registration

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: EEF

Description

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval. This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta from 2.3.0 before 2.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-65635

EUVD

EUVD-2026-51144

Affected Vendors & Products

Vendor	Product	Version / Range
malach-it	boruta	From 2.3.0 (inc) to 2.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-653	The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Attack-Flow Graph

Executive Summary

This vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with admin privileges. The register_client/3 function forwards user-supplied parameters to admin client creation without proper validation, letting unauthenticated users set sensitive security attributes like grant types, scopes, and token settings.

Detection Guidance

To detect this vulnerability, check if your boruta instance is running a version between 2.3.0 and 2.3.6. Inspect the Elixir.Boruta.Openid.register_client/3 function in lib/boruta/openid.ex for improper parameter handling. Look for unauthorized client registrations with administrative privileges.

Impact Analysis

An attacker could exploit this to create malicious clients with elevated privileges, potentially gaining unauthorized access to protected resources, intercepting tokens, or impersonating legitimate users. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining authentication controls. GDPR and HIPAA require strict access controls and data protection; this flaw may lead to non-compliance due to potential data exposure or unauthorized system access.

Mitigation Strategies

Upgrade boruta to version 2.3.7 or later to address the vulnerability in the OpenID module. Review and restrict dynamic client registration settings to prevent unauthorized administrative privilege escalation. Monitor logs for suspicious client registration attempts.

Hi! I’m here to help you understand CVE-2026-65635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70