https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:13:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343211 EUVD-2026-343211 https://cve.radiocsirt.org/vuln/euvd-2026-343211 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65635 <p>Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.</p> <p>This vulnerability is associated with program files lib/boruta/openid.ex and program routines &#39;Elixir.Boruta.Openid&#39;:register_client/3, &#39;Elixir.Boruta.Openid&#39;:parse_registration_params/2.</p> <p>This issue affects boruta from 2.3.0 before 2.3.7.</p> <p>Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.</p> <p>This vulnerability is associated with program files lib/boruta/openid.ex and program routines &#39;Elixir.Boruta.Openid&#39;:register_client/3, &#39;Elixir.Boruta.Openid&#39;:parse_registration_params/2.</p> <p>This issue affects boruta from 2.3.0 before 2.3.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65635