CVE-2026-53431

🗓️ 30 Jul 2026 14:17:27Reported by EEFType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

Boruta fails to validate exp in JWT client assertions, enabling replay and authentication bypass.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-53431	30 Jul 202614:17	–	attackerkb
Circl	CVE-2026-53431	30 Jul 202615:34	–	circl
Cvelist	CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation	30 Jul 202614:17	–	cvelist
EUVD	EUVD-2026-51145	30 Jul 202614:17	–	euvd
Mend	CVE-2026-53431	30 Jul 202614:17	–	mend
NVD	CVE-2026-53431	30 Jul 202615:16	–	nvd
osv_cve	CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation	30 Jul 202614:17	–	osv_cve
osv_eef	EEF-CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation	30 Jul 202614:17	–	osv_eef
Positive Technologies	PT-2026-66491	30 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-53431: Authentication Bypass by Capture-replay	30 Jul 202600:00	–	rapid7

Vulners

CNA

Node

malach-it boruta_authRange<2.3.7

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Boruta.Oauth.Request.Base'",
      "'Elixir.Boruta.Oauth.Authorization.Client.Token'"
    ],
    "packageName": "boruta",
    "packageURL": "pkg:hex/boruta",
    "product": "boruta",
    "programFiles": [
      "lib/boruta/oauth/request/base.ex",
      "lib/boruta/oauth/authorization/client.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Boruta.Oauth.Request.Base':fetch_client_authentication/1"
      },
      {
        "name": "'Elixir.Boruta.Oauth.Request.Base':check_expiration/1"
      },
      {
        "name": "'Elixir.Boruta.Oauth.Authorization.Client.Token':token_config/0"
      }
    ],
    "repo": "https://github.com/malach-it/boruta_auth",
    "vendor": "malach-it",
    "versions": [
      {
        "lessThan": "2.3.7",
        "status": "affected",
        "version": "2.3.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Boruta.Oauth.Request.Base'",
      "'Elixir.Boruta.Oauth.Authorization.Client.Token'"
    ],
    "packageName": "malach-it/boruta_auth",
    "packageURL": "pkg:github/malach-it/boruta_auth",
    "product": "boruta",
    "programFiles": [
      "lib/boruta/oauth/request/base.ex",
      "lib/boruta/oauth/authorization/client.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Boruta.Oauth.Request.Base':fetch_client_authentication/1"
      },
      {
        "name": "'Elixir.Boruta.Oauth.Request.Base':check_expiration/1"
      },
      {
        "name": "'Elixir.Boruta.Oauth.Authorization.Client.Token':token_config/0"
      }
    ],
    "repo": "https://github.com/malach-it/boruta_auth",
    "vendor": "malach-it",
    "versions": [
      {
        "changes": [
          {
            "at": "5204f88f9b2cdd9637a755337ed5f99185be5474",
            "status": "unaffected"
          },
          {
            "at": "69363432aa36760fc5438e4e17115d0f7c1b925a",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "5bfbe1c5443bffe71cf1bf954bbdff61327d9a83",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
github	www.github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a
github	www.github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6
cna	www.cna.erlef.org/cves/CVE-2026-53431.html
github	www.github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474
osv	www.osv.dev/vulnerability/EEF-CVE-2026-53431

Parameter	Position	Path	Description	CWE
client_secret_jwt	request body	/token	Authentication bypass via capture-replay of expired JWT client assertions (client_secret_jwt or private_key_jwt) because the application fails to enforce the 'exp' claim.	CWE-294
private_key_jwt	request body	/token	Authentication bypass via capture-replay of expired JWT client assertions (client_secret_jwt or private_key_jwt) because the application fails to enforce the 'exp' claim.	CWE-294

31 Jul 2026 04:20Current

5.8Medium risk

Vulners AI Score5.8

CVSS 49.1

EPSS0.00701

SSVC

CWE-294