Read the docs
TI-2026-39899 Aliases CVE-2026-55221

Boruta: OAuth credentials exposed in Boruta business logs

Priority LOW 31CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with access to Boruta logs, log aggregation systems, or the administration log viewer could recover these credentials and use them until expiration or revocation. This issue has been patched in version 0.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00482 41st percentileScored 2026-11-07
Fix Fixed boruta-server (malach-it): 0.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
malach-itboruta-serverbefore 0.10.00.10.0Patch availableCNA
  • boruta-server Vendormalach-it Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA

Remediation

  • Fix · CNA boruta-server (malach-it) Fixed in 0.10.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55221

References

Other 3

  • TI-2026-38513 Boruta accepts expired JWT client assertions due to missing exp claim validation CVSS 4.0CRITICAL 9.1
  • TI-2026-46784 Boruta dynamic client registration allows creation of over-privileged OAuth clients CVSS 4.0HIGH 8.3
  • TI-2026-39658 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching CVSS 4.0MEDIUM 6.9
  • TI-2026-36446 Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2 CVSS 4.0HIGH 7.1
  • TI-2026-38702 boruta-server sent sensitive session cookies without the Secure attribute CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences