← Vulnerability feed

Vulnerability record · CVE-2026-65635 · published 30 July 2026

CVE-2026-65635: Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) all…

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval. This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta from 2.3.0 before 2.3.7.

8.3 CVSS 4.0 High EPSS 0.52% · top 57.9% CWE-653 · CWE-653 Deferred
8.3CVSS 4.0 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
6References
30 Jul 2026Last modified by NVD

Description

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval. This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta from 2.3.0 before 2.3.7.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://cna.erlef.org/cves/CVE-2026-65635.html
https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643
https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525
https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp
https://osv.dev/vulnerability/EEF-CVE-2026-65635
https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp

Track CVE-2026-65635 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.7CVE-2025-21590Juniper Junos OS kernel improper isolation allows local code injectionJunos OS contains an improper isolation or compartmentalization flaw in the kernel that lets a local attacker with shell access inject arbitrary code…KEVEPSS 1.7%analysed

Source: NIST National Vulnerability Database (record CVE-2026-65635), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.