JWT client assertion expiration bypass in Boruta OAuth library (CVE-2026-53431)

Boruta's OAuth 2.0/OIDC token endpoint accepts JWT-based client assertions (client_secret_jwt and private_key_jwt) without enforcing that the exp claim is in the future. The pre-check helper verifies only that an exp claim exists, and the Joken token configuration omits default expiration validation entirely. An attacker who obtains any previously-valid signed client assertion can replay it indefinitely to authenticate as the issuing client and obtain access tokens with that client's privileges. Affected versions: - >= 2.3.0 and < 2.3.7 We recommend updating to: 2.3.7. CVSS 9.1 · our assessment: act_now Reference: https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6 Details: https://vuln.today/cve/CVE-2026-53431