CVE-2026-65635 Details

A vulnerability in the Malach-it Boruta library, specifically within the Elixir.Boruta.Openid module, allows for the improper registration of OpenID Connect clients with administrative privileges. This issue arises in versions 2.3.0 prior to 2.3.7. The vulnerability is rooted in the dynamic client registration process, where the 'register_client/3' function forwards user-supplied registration parameters to the administrative client creation pathway without a proper allowlist to separate public and admin fields. As a result, an unauthenticated registrant can manipulate sensitive attributes such as grant types, scopes, PKCE enforcement, refresh and revocation behaviors, token lifetimes, and signing settings. The library fails to differentiate between metadata that public registrants can set and administrative controls that require operator approval.

Users can update to Boruta version 2.3.7, which addresses this vulnerability by implementing a proper allowlist for registration parameters. If dynamic client registration must remain available to untrusted callers, it is recommended to disable the administrative attributes in the registration process or restrict the registration route to authenticated administrators.