CVE-2026-53431 Details

A vulnerability in Malach-it Boruta versions 2.3.0 prior to 2.3.7 allows authentication bypass by capture-replay of expired JSON Web Token (JWT) client assertions. Boruta's OAuth 2.0 and OpenID Connect token endpoints accept JWT-based client authentication methods (client_secret_jwt and private_key_jwt) but fail to properly validate the expiration claim of the assertions. This oversight enables an attacker to reuse a validly-signed client assertion after its expiration to authenticate as the issuing client and obtain access tokens with that client's privileges. The vulnerability arises because the pre-check helper only verifies the presence of the exp claim without comparing it to the current time, and the Joken token configuration used for signature verification does not engage the default exp claim validator, allowing expired assertions to be accepted.

Users can update to Boruta version 2.3.7, where this vulnerability has been patched. For deployments that must use JWT-based client authentication, it is recommended to issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay.