AIKIDO-2026-444485
boruta is vulnerable to Improper Isolation
83
High Risk
This Affects:
borutaTL;DR
Boruta.Openid.register_client/3 forwards caller-supplied registration parameters into the administrative client-creation path after only rewriting a few OIDC keys, with no allowlist separating public registration metadata from admin-only controls. An unauthenticated caller who can reach a network endpoint that exposes this function can register an OAuth client with admin-reserved settings such as grant types, scopes, PKCE, revocation flags, and token lifetimes. That over-privileged client can then obtain tokens and exercise capabilities the deployment intended to reserve for administrators. The fix restricts dynamic registration so public callers cannot set administrative client fields.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and expose Boruta.Openid.register_client/3 on a network endpoint without a trusted initial access token or a strict server-side parameter allowlist.
Background info
boruta is vulnerable to Improper Isolation in versions 2.3.0 - 2.3.6.
How to fix this
Upgrade the boruta library to the patch version.
Links
Fix Commits
github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.