Packages

boruta

2.3.8
3.0.0-beta.4 3.0.0-beta.3 3.0.0-beta.2 3.0.0-beta.1 2.3.8 2.3.7 2.3.6 2.3.5 2.3.4 2.3.3 2.3.2 2.3.1 2.3.0 2.2.2 2.2.1 2.2.0 2.1.5 2.1.4 2.1.3 2.1.2 2.1.1 2.1.0 2.0.1 2.0.0 2.0.0-rc.1 2.0.0-rc.0 1.2.1 1.2.0 1.1.0 1.0.3 1.0.2 1.0.1 1.0.0 1.0.0-rc.3 1.0.0-rc.2 1.0.0-rc.1 1.0.0-rc.0 0.2.1 0.2.0 0.1.1 0.1.0 0.1.0-rc.5 0.1.0-rc.4 0.1.0-rc.3 0.1.0-rc.2 0.1.0-rc.1

Core of an OAuth/OpenID Connect provider enabling authorization in your applications.

HexDocs Report package

Current section

3 Advisories

Jump to
Readme
46 Versions
14 Dependencies
0 Dependants
3 Advisories
Files
Activity
EEF-CVE-2026-53431 CVE-2026-53431 GHSA-xjv8-vmh5-xhf6

Boruta accepts expired JWT client assertions due to missing exp claim validation

July 30, 2026
CVSS
?
9.1 / 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 2.3.0 and < 2.3.7
EEF-CVE-2026-65635 CVE-2026-65635 GHSA-w869-fcf2-68vp

Boruta dynamic client registration allows creation of over-privileged OAuth clients

July 30, 2026
CVSS
?
8.3 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

Affected Versions

>= 2.3.0 and < 2.3.7
EEF-CVE-2026-54885 CVE-2026-54885 GHSA-5q9h-vf5j-fr2g

Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

July 30, 2026
CVSS
?
6.9 / 10.0 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected Versions

>= 2.3.2 and < 2.3.7

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions
0 500 1000 1500 2000

this version

7 638

yesterday

2 355

last 7 days

10 426

all time

500 703

Last Updated

Aug 01, 2026

License

MIT

Build Tools

mix

Publisher

patatoid patatoid

Links

Owners