CVE-2026-53431: boruta 2.3.0 to before 2.3.7

Affected technology

boruta · 2.3.0 to before 2.3.7
malach-it

boruta · 5bfbe1c5443bffe71cf1bf954bbdff61327d9a83 to before *; status changes: 5204f88f9b2cdd9637a755337ed5f99185be5474 — unaffected, 69363432aa36760fc5438e4e17115d0f7c1b925a — unaffected
malach-it

Component: 'Elixir.Boruta.Oauth.Request.Base', 'Elixir.Boruta.Oauth.Authorization.Client.Token'
Function: 'Elixir.Boruta.Oauth.Request.Base':fetch_client_authentication/1, 'Elixir.Boruta.Oauth.Request.Base':check_expiration/1, 'Elixir.Boruta.Oauth.Authorization.Client.Token':token_config/0
File: lib/boruta/oauth/request/base.ex, lib/boruta/oauth/authorization/client.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could get past authentication checks under the conditions described by the source. Source advisory’s CVSS 4.0 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.