CVE-2026-65635: boruta 2.3.0 to before 2.3.7

Affected technology

boruta · 2.3.0 to before 2.3.7
malach-it

boruta · 85481b706636fe68a43d0b8d3275e2afc7f7fee1 to before *; status changes: 82584c854a332482232fd25301ab12a835f9f643 — unaffected, 95619a1beaff68fa766cca9b388e7c780d182525 — unaffected
malach-it

Component: Elixir.Boruta.Openid
Function: 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2
File: lib/boruta/openid.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 8.3/10) rates confidentiality and availability impact as low; integrity impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.