CVE-2026-53431

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client's privileges. This issue affects boruta: from 2.3.0 before 2.3.7.

• CWE-294

• https://cna.erlef.org/cves/CVE-2026-53431.html
• https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474
• https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a
• https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6
• https://osv.dev/vulnerability/EEF-CVE-2026-53431
• https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6

Published

Jul 30, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53426Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-53427Improper Neutralization of Input During Web Page Generation …2.3
• CVE-2026-53428Memory Allocation with Excessive Size Value vulnerability in…6.9
• CVE-2026-53429Missing Release of Memory after Effective Lifetime vulnerabi…6.9
• CVE-2026-5343Improper Check for Unusual or Exceptional Conditions vulnera…7.4
• CVE-2026-53430Improper Handling of Highly Compressed Data (Data Amplificat…8.7
• CVE-2026-53432fzf is vulnerable to Integer Overflow leading to crash in Fu…7.5
• CVE-2026-53433fzf is vulnerable to a Denial of Service (DoS) due to ineffi…7.5
• CVE-2026-53434Detection of Error Condition Without Action vulnerability in…9.1
• CVE-2026-53435In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is…8.8
• CVE-2026-53436Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperl…4.3
• CVE-2026-53437Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperl…4.3