boruta-server vulnerabilities

2 known vulnerabilities in boruta-server from Malach-it. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  boruta-server: Uncontrolled Resource Consumption

  CVE-2026-49249Sep 2, 2026Malach-it

  Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied requ

• 8.8 High severity

  boruta-server: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

  CVE-2026-53661Jun 11, 2026Malach-it

  Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set without the Secure attrib