Hex/boruta CVE-2026-53431: critical 9.1, EPSS 0.51%
Boruta accepts expired JWT client assertions due to missing exp claim validation
Action: Upgrade boruta to 2.3.7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.3.0 | 2.3.7 | - |
Fixed versions
| 2.3.7 |
Sources
- osv: EEF-CVE-2026-53431
- nvd: CVE-2026-53431
- https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6
- https://cna.erlef.org/cves/CVE-2026-53431.html
- https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474
- https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a
- https://hex.pm/packages/boruta
CVE-2026-53431 · published · modified · JSON