CVE-2026-65635— Boruta dynamic client registration allows creation of over-privileged OAuth clients
Possible ATT&CK Techniques 1AI
T1136.003 · Cloud AccountGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-65635
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Boruta dynamic client registration allows creation of over-privileged OAuth clients
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval. This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta from 2.3.0 before 2.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的划分
Source: CVE Program / CVE List V5
Vulnerability Title
malach-it Boruta 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
malach-it Boruta是malach-it组织开源的一个OAuth 2.0 和 OpenID Connect 提供程序的核心。 malach-it Boruta 2.3.0版本至2.3.7之前版本存在权限许可和访问控制问题漏洞，该漏洞源于Elixir.Boruta.Openid模块的register_client/3函数将调用者提供的注册参数直接转发给管理员客户端创建路径，缺少公共/管理员字段级白名单，导致未认证注册者可以设置安全敏感属性（包括授权范围、令牌生存期等），从而注册具有管理员权限的O
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-65635
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7518 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-65635
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-65635 (2)
Vendor Advisories for CVE-2026-65635 (3)
- 🔗 EEF-CVE-2026-65635 - OSVrelated
Same Patch Batch · malach-it · 2026-07-30 · 3 CVEs total
| CVE-2026-53431 | 9.1 CRITICAL | Boruta accepts expired JWT client assertions due to missing exp claim validation |
| CVE-2026-54885 | 6.9 MEDIUM | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching |
IV. Related Vulnerabilities
Same weakness: CWE-653
- CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector - CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groo - CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass - CVE-2026-15738
Cross-namespace traffic interception via incorrect route pre - CVE-2026-41155
GPU DDK - SharedSecMem mapped into all GPU virtual address s
V. Comments for CVE-2026-65635
No comments yet