CVE-2026-54885

🗓️ 30 Jul 2026 14:16:43Reported by EEFType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

Boruta SSRF via OAuth/OpenID request_uri and jwks_uri on three paths.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-54885	30 Jul 202614:16	–	attackerkb
Cvelist	CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching	30 Jul 202614:16	–	cvelist
EUVD	EUVD-2026-51143	30 Jul 202614:16	–	euvd
Mend	CVE-2026-54885	30 Jul 202614:16	–	mend
NVD	CVE-2026-54885	30 Jul 202615:16	–	nvd
osv_cve	CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching	30 Jul 202614:16	–	osv_cve
osv_eef	EEF-CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching	30 Jul 202614:16	–	osv_eef
Positive Technologies	PT-2026-66492	30 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-54885: Server-Side Request Forgery (SSRF)	30 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching	30 Jul 202614:16	–	vulnrichment

Vulners

CNA

Node

malach-it boruta_authRange<2.3.7

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Boruta.Oauth.Request.Base'",
      "'Elixir.Boruta.Openid'",
      "'Elixir.Boruta.Ecto.Clients'"
    ],
    "packageName": "boruta",
    "packageURL": "pkg:hex/boruta",
    "product": "boruta",
    "programFiles": [
      "lib/boruta/oauth/request/base.ex",
      "lib/boruta/openid.ex",
      "lib/boruta/adapters/ecto/clients.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Boruta.Oauth.Request.Base':fetch_unsigned_request/1"
      },
      {
        "name": "'Elixir.Boruta.Openid':parse_registration_params/2"
      },
      {
        "name": "'Elixir.Boruta.Ecto.Clients':refresh_jwk_from_jwks_uri/1"
      }
    ],
    "repo": "https://github.com/malach-it/boruta_auth",
    "vendor": "malach-it",
    "versions": [
      {
        "lessThan": "2.3.7",
        "status": "affected",
        "version": "2.3.2",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Boruta.Oauth.Request.Base'",
      "'Elixir.Boruta.Openid'",
      "'Elixir.Boruta.Ecto.Clients'"
    ],
    "packageName": "malach-it/boruta_auth",
    "packageURL": "pkg:github/malach-it/boruta_auth",
    "product": "boruta",
    "programFiles": [
      "lib/boruta/oauth/request/base.ex",
      "lib/boruta/openid.ex",
      "lib/boruta/adapters/ecto/clients.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Boruta.Oauth.Request.Base':fetch_unsigned_request/1"
      },
      {
        "name": "'Elixir.Boruta.Openid':parse_registration_params/2"
      },
      {
        "name": "'Elixir.Boruta.Ecto.Clients':refresh_jwk_from_jwks_uri/1"
      }
    ],
    "repo": "https://github.com/malach-it/boruta_auth",
    "vendor": "malach-it",
    "versions": [
      {
        "changes": [
          {
            "at": "001e3dc5c259e67c6f907e98867eda4141c96d0d",
            "status": "unaffected"
          },
          {
            "at": "95fb10b78129355e475681f324c9a01ef0af2be5",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "15455b86206e0370eabd64c1856a5c996b436455",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
github	www.github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g
github	www.github.com/malach-it/boruta_auth/commit/95fb10b78129355e475681f324c9a01ef0af2be5
github	www.github.com/malach-it/boruta_auth/commit/001e3dc5c259e67c6f907e98867eda4141c96d0d
cna	www.cna.erlef.org/cves/CVE-2026-54885.html
osv	www.osv.dev/vulnerability/EEF-CVE-2026-54885

Parameter	Position	Path	Description	CWE
request_uri	query param	/oauth/request	The Boruta.Oauth.Request.Base.fetch_unsigned_request/1 function dereferences the request_uri parameter from an OAuth request without sufficient validation, leading to SSRF.	CWE-918
jwks_uri	query param	/openid/registration	The Boruta.Openid.parse_registration_params/2 function dereferences the jwks_uri parameter in an OpenID Connect dynamic client registration request without sufficient validation, leading to SSRF.	CWE-918
jwks_uri	query param	/clients/refresh_jwk	The Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 function refreshes the stored jwks_uri for an existing client without sufficient validation, leading to SSRF.	CWE-918

31 Jul 2026 04:20Current

6.2Medium risk

Vulners AI Score6.2

CVSS 46.9

EPSS0.00612

SSVC

CWE-918