—Hex
EEF-CVE-2026-53431· CVE-2026-53431, GHSA-xjv8-vmh5-xhf6Boruta accepts expired JWT client assertions due to missing exp claim validation
Modified: 9/8/2026
package
pkg:hex/boruta
Boruta accepts expired JWT client assertions due to missing exp claim validation
Modified: 9/8/2026
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Modified: 9/8/2026
Boruta dynamic client registration allows creation of over-privileged OAuth clients
Modified: 9/8/2026