Boruta dynamic client registration allows creation of over-privileged OAuth clients

Weakness Type (CWE)

CWE-653 — CWE-653 Improper Isolation or Compartmentalization

CAPEC

CAPEC-1 — CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

CVSS 4.0 Score

8.3

HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

Vulnerability description

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.

This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2.

This issue affects boruta from 2.3.0 before 2.3.7.

Affected

`pkg:hex/boruta`

Module	Source File	Routine
`Elixir.Boruta.Openid`	`lib/boruta/openid.ex`	`Boruta.Openid.register_client/3`
		`Boruta.Openid.parse_registration_params/2`

Status	Type	Version	Changes / Fixed in
affected	semver ^ⓘ	`2.3.0`	< `2.3.7`

`pkg:github/malach-it/boruta_auth`

Module	Source File	Routine
`Elixir.Boruta.Openid`	`lib/boruta/openid.ex`	`Boruta.Openid.register_client/3`
		`Boruta.Openid.parse_registration_params/2`

Status	Type	Version	Changes / Fixed in
affected	git ^ⓘ	`85481b7066`	unaffected at `82584c854a` unaffected at `95619a1bea`

Configurations

A deployment is vulnerable when the host application exposes Boruta.Openid.register_client/3 on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call Boruta.Openid.register_client/3 from a public endpoint are not exploitable.

Workarounds

Disable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to Boruta.Openid.register_client/3 directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function.

References

Credits

Finder: Pascal Knoth
Remediation developer: Pascal Knoth
Analyst: Jonatan Männchen / EEF

CVE record as JSON: GET /cves/CVE-2026-65635.json
OSV record as JSON: GET /osv/EEF-CVE-2026-65635.json