Malach-it vulnerabilities
We track 4 vulnerabilities in Malach-it products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 2, 2026.
Latest Malach-it vulnerabilities
- 7.1 High severity
boruta-server: Uncontrolled Resource Consumption
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied requ
- 8.3 High severity
boruta: Improper Isolation or Compartmentalization
Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.reg
- 9.1 Critical severity
boruta: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client a
- 8.8 High severity
boruta-server: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set without the Secure attrib