—Hex
EEF-CVE-2026-53431· CVE-2026-53431, GHSA-xjv8-vmh5-xhf6Boruta accepts expired JWT client assertions due to missing exp claim validation
Modified: 9/8/2026
package
Hex/boruta
pkg:hex/boruta
—Hex
EEF-CVE-2026-54885· CVE-2026-54885, GHSA-5q9h-vf5j-fr2gServer-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Modified: 9/8/2026
—Hex
EEF-CVE-2026-65635· CVE-2026-65635, GHSA-w869-fcf2-68vpBoruta dynamic client registration allows creation of over-privileged OAuth clients
Modified: 9/8/2026