AIKIDO-2026-599510

TL;DR

Boruta fetches attacker-controlled URIs from request_uri on the authorization endpoint and from jwks_uri during dynamic client registration and client JWKS refresh, after only checking that the URI has a scheme. Those GETs go through Finch with no HTTPS requirement, host allowlist, private-range blocking, response size limit, or redirect controls. An unauthenticated attacker can therefore force the authorization server to issue outbound requests to internal services, loopback addresses, or cloud metadata endpoints (blind SSRF). The fix constrains remote URI fetching so these parameters cannot target arbitrary internal hosts.