Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-53661

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set without the Secure attribute. In deployments where users could reach the same Boruta origin over plaintext HTTP, browsers could send these cookies over an unencrypted connection. An attacker able to observe or intercept that network traffic could recover a valid se
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:5feb621fdfb1c1551e9a28eb878d64a60916f98d344abb8d1d6e2ab0ece33244
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"boruta-server","vendor":"malach-it","versions":[{"status":"affected","version":"< 0.9.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:761c0b987d825957b1ca4b27069d7311e9a8a68623bce03e014b338101fd6c8a · sha256:6dba8d85cbefc7f4… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.8,"baseSeverity":"HIGH","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:761c0b987d825957b1ca4b27069d7311e9a8a68623bce03e014b338101fd6c8a · sha256:6dba8d85cbefc7f4… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-614","description":"CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:761c0b987d825957b1ca4b27069d7311e9a8a68623bce03e014b338101fd6c8a · sha256:6dba8d85cbefc7f4… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/malach-it/boruta-server/commit/18691c655164635066aa113003a3cd87f6ed11cd","tags":["x_refsource_MISC"],"url":"https://github.com/malach-it/boruta-server/commit/18691c655164635066aa113003a3cd87f6ed11cd"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:761c0b987d825957b1ca4b27069d7311e9a8a68623bce03e014b338101fd6c8a · sha256:6dba8d85cbefc7f4… · /containers/cna/references/2
{"name":"https://github.com/malach-it/boruta-server/security/advisories/GHSA-jqgm-pfg6-cr8r","tags":["x_refsource_MISC"],"url":"https://github.com/malach-it/boruta-server/security/advisories/GHSA-jqgm-pfg6-cr8r"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:761c0b987d825957b1ca4b27069d7311e9a8a68623bce03e014b338101fd6c8a · sha256:6dba8d85cbefc7f4… · /containers/cna/references/1
{"name":"https://github.com/malach-it/boruta_auth/security/advisories/GHSA-7355-8c95-25pv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/malach-it/boruta_auth/security/advisories/GHSA-7355-8c95-25pv"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:761c0b987d825957b1ca4b27069d7311e9a8a68623bce03e014b338101fd6c8a · sha256:6dba8d85cbefc7f4… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer