CVE-2026-65635 malach-it CVE debrief

Who should care

Defenders responsible for OpenID Connect client registration and management, as well as administrators of systems using the affected library, should assess exposure and take action to restrict client registration and limit administrative privileges.

Why it matters

CVE-2026-65635 is a high-severity vulnerability in the malach-it boruta library that allows attackers to register OpenID Connect clients with administrative privileges, potentially leading to unauthorized access or manipulation of client settings.

• An attacker could register a malicious OpenID Connect client with administrative privileges, potentially allowing unauthorized access to sensitive systems or data.
• Defenders may need to verify and restrict OpenID Connect client registration to prevent unauthorized access.
• The vulnerability could allow an attacker to manipulate client settings, such as supported grant types, authorized scopes, and token lifetimes.

Technical summary

The malach-it boruta library does not properly isolate or compartmentalize OpenID Connect client registration, allowing attackers to register clients with administrative privileges. The library forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist. This could allow an attacker to manipulate client settings, such as supported grant types, authorized scopes, and token lifetimes. Defenders should prioritize verifying and restricting OpenID Connect client registration and reviewing and limiting administrative privileges.

Defensive priority

Defenders should prioritize verifying and restricting OpenID Connect client registration, reviewing and limiting administrative privileges, and monitoring for suspicious client registration activity.

Recommended defensive actions

• Verify and restrict OpenID Connect client registration
• Review and limit administrative privileges
• Monitor for suspicious client registration activity
• Update to version 2.3.7 or later
• Perform vulnerability scanning and asset inventory
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and references to source-specific vulnerability assessments. The vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. Evidence is limited to public CVE and NVD information. Defenders should verify OpenID Connect client registration processes and review administrative privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.