boruta vulnerabilities (Hex)

3 vulnerabilities.

• boruta Hex Boruta accepts expired JWT client assertions due to missing exp claim validation CVE-2026-53431 Fix available 9.1 CriticalJuly 30, 2026
• boruta Hex Boruta dynamic client registration allows creation of over-privileged OAuth clients CVE-2026-65635 Fix available 8.3 HighJuly 30, 2026
• boruta Hex Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching CVE-2026-54885 Fix available 6.9 MediumJuly 30, 2026