CVE-2026-54885
1 advisory.
Hex/boruta CVE-2026-54885: medium 6.9, EPSS 0.47%
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Action: Upgrade boruta to 2.3.7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.3.2 | 2.3.7 | - |
Fixed versions
| 2.3.7 |
Sources
- osv: EEF-CVE-2026-54885
- nvd: CVE-2026-54885
- https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g
- https://cna.erlef.org/cves/CVE-2026-54885.html
- https://github.com/malach-it/boruta_auth/commit/001e3dc5c259e67c6f907e98867eda4141c96d0d
- https://github.com/malach-it/boruta_auth/commit/95fb10b78129355e475681f324c9a01ef0af2be5
- https://hex.pm/packages/boruta
CVE-2026-54885 · published · modified · JSON