CVE-2026-54885: boruta 2.3.2 to before 2.3.7

Affected technology

boruta · 2.3.2 to before 2.3.7
malach-it

boruta · 15455b86206e0370eabd64c1856a5c996b436455 to before *; status changes: 001e3dc5c259e67c6f907e98867eda4141c96d0d — unaffected, 95fb10b78129355e475681f324c9a01ef0af2be5 — unaffected
malach-it

Component: 'Elixir.Boruta.Oauth.Request.Base', 'Elixir.Boruta.Openid', 'Elixir.Boruta.Ecto.Clients'
Function: 'Elixir.Boruta.Oauth.Request.Base':fetch_unsigned_request/1, 'Elixir.Boruta.Openid':parse_registration_params/2, 'Elixir.Boruta.Ecto.Clients':refresh_jwk_from_jwks_uri/1
File: lib/boruta/oauth/request/base.ex, lib/boruta/openid.ex, lib/boruta/adapters/ecto/clients.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality, integrity and availability impact as none.