TI-2026-38513 Aliases CVE-2026-53431

Boruta accepts expired JWT client assertions due to missing exp claim validation

HIGH 74CWE-294Published 2026-07-30 · Updated 2026-07-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client's privileges. This issue affects boruta: from 2.3.0 before 2.3.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00511 43rd percentileScored 2026-11-07

Fix Fixed boruta (malach-it): 2.3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
malach-it	boruta	2.3.0 to before 2.3.7	2.3.7	Patch available	CNA

boruta Vendormalach-it Affected 2.3.0 to before 2.3.7 Fixed in 2.3.7 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:malach-it:boruta_auth::::::::	—	—	—

cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA boruta (malach-it) Fixed in 2.3.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-30
malach-it boruta 2.3.7
3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-46784 Boruta dynamic client registration allows creation of over-privileged OAuth clientsPriority HIGH 69
- TI-2026-39658 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetchingPriority MEDIUM 64
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-53431
2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 1

https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6

Other 2

TI-2026-46784 Boruta dynamic client registration allows creation of over-privileged OAuth clients CVSS 4.0HIGH 8.3
TI-2026-39658 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching CVSS 4.0MEDIUM 6.9
TI-2026-36446 Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2 CVSS 4.0HIGH 7.1
TI-2026-38702 boruta-server sent sensitive session cookies without the Secure attribute CVSS 4.0HIGH 8.8
TI-2026-39899 Boruta: OAuth credentials exposed in Boruta business logs CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences