CVE-2026-55221
Received Received - Intake

Sensitive Token Exposure in Boruta Authorization Server

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with access to Boruta logs, log aggregation systems, or the administration log viewer could recover these credentials and use them until expiration or revocation. This issue has been patched in version 0.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-55221
EUVD
EUVD-2026-70239

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
boruta boruta to 0.10.0 (exc)
malach-it boruta to 0.10.0 (exc)
malach-it boruta to 0.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Boruta versions before 0.10.0 logging sensitive OAuth and OpenID Connect credentials in business event logs. These credentials include access tokens, refresh tokens, authorization codes, and other tokens. Attackers with access to these logs could recover and misuse these credentials until they expire or are revoked.

Detection Guidance

Check Boruta logs for exposed OAuth credentials like access tokens, refresh tokens, or authorization codes. Search for patterns such as 'access_token=', 'refresh_token=', or 'code=' in log files. Use commands like grep 'access_token=' /var/log/boruta/*.log or journalctl -u boruta | grep 'token=' to inspect logs for sensitive data.

Impact Analysis

If you use Boruta versions before 0.10.0, an attacker with access to logs could steal credentials and gain unauthorized access to protected resources. The impact depends on token lifetime, scopes, log retention, and who can access the logs. Affected tokens should be rotated and logs purged.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized exposure of sensitive credentials in logs. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Logging credentials increases risk of breaches and non-compliance.

Mitigation Strategies

Upgrade Boruta to version 0.10.0 or later to patch the vulnerability. Rotate all exposed OAuth client credentials, revoke potentially leaked tokens, and purge existing logs generated by affected versions to prevent credential recovery.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart