EUVD-2026-70239Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
PR:H because log or admin viewer access is required; C:H/I:H because recovered tokens enable full credential replay and downstream impersonation.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with access to Boruta logs, log aggregation systems, or the administration log viewer could recover these credentials and use them until expiration or revocation. This issue has been patched in version 0.10.0.
AnalysisAI
Sensitive token logging in Boruta Server before 0.10.0 allows any party with read access to business event logs - including log aggregation systems and the built-in administration log viewer - to recover live OAuth 2.0 and OpenID Connect credentials. Exposed values include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens logged during normal authorization and token issuance flows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires read access to Boruta's business event logs - either through the built-in administration log viewer (requiring admin-level credentials to the Boruta admin interface), direct filesystem access to log files on the server, or read access to an external log aggregation or SIEM system to which Boruta forwards logs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N scores 6.5, reflecting that exploitation requires high-privilege access (PR:H) to logs or the admin viewer, which meaningfully constrains the attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Boruta Server version 0.10.0, which removes all sensitive token fields from business event log emission across authorize_controller.ex, token_controller.ex, and logger.ex. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Boruta Server
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today