AIKIDO-2026-336324

TL;DR

Boruta.Oauth.Request.Base.fetch_client_authentication/1 accepts JWT client assertions for client_secret_jwt and private_key_jwt, but its check_expiration/1 helper only verifies that an exp claim exists and never compares it to the current time. Signature verification through Boruta.Oauth.Authorization.Client.Token also uses an empty Joken config, so expired assertions still validate. An attacker who obtains a previously valid signed client_assertion can replay it after expiry at the token endpoint and mint access tokens as that client. The fix enforces JWT exp validation for client assertions.