CVE-2026-55221: Boruta OAuth Server Information Disclosure

CVE-2026-55221 Overview

CVE-2026-55221 is an information disclosure vulnerability in Boruta, a standalone authorization server implementing OAuth 2.0 and OpenID Connect specifications. Versions prior to 0.10.0 log sensitive OAuth and OpenID Connect values to business event logs. Exposed values include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with access to Boruta logs, log aggregation systems, or the administration log viewer can recover these credentials and reuse them until they expire or are revoked. The maintainers patched the issue in version 0.10.0.

Critical Impact
Attackers with log access can extract valid OAuth tokens and impersonate authenticated users or clients until token expiration.

Affected Products

Boruta authorization server versions prior to 0.10.0
Deployments exposing OAuth 2.0 authorization endpoints
Deployments exposing OpenID Connect and Verifiable Presentation token flows

Discovery Timeline

2026-09-02 - CVE-2026-55221 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-55221

Vulnerability Analysis

Boruta emits structured business event logs from its OAuth and OpenID Connect controllers. Before version 0.10.0, these log entries include the raw credential material returned to clients. The affected fields cover access_token, refresh_token, agent_token, authorization codes returned in the code response type, id_token, vp_token used in verifiable presentation flows, and tokens submitted to the introspection and revocation endpoints.

Any principal that can read the logs gains the same authority as the credential holder. This includes SREs with log aggregation access, administrators using the built-in log viewer, and attackers who compromise the logging pipeline. Because OAuth bearer tokens do not require proof of possession by default, replay is trivial until the token expires or is explicitly revoked.

The weakness is classified as [CWE-532] Insertion of Sensitive Information into Log File.

Root Cause

Controller functions in boruta_web passed the full response struct — including token material — to the business event logger. The token controller emitted access_token, agent_token, and refresh_token fields alongside routine metadata. The authorize controller emitted response codes and tokens during code, id_token, and vp_token flows. No redaction layer sat between the response builder and the log sink.

Attack Vector

Exploitation requires read access to Boruta log output. Once obtained, the attacker parses log entries, extracts token strings, and submits them to protected resource servers or the userinfo endpoint. Direct-post codes and authorization codes recovered from logs can be exchanged at the token endpoint if not yet consumed.

text

// Patch to apps/boruta_web/lib/boruta_web/controllers/oauth/token_controller.ex
      %{
        client_id: response.token.client.id,
        sub: response.token.sub,
-       access_token: response.access_token,
-       agent_token: response.agent_token,
        token_type: response.token_type,
-       expires_in: response.expires_in,
-       refresh_token: response.refresh_token
+       expires_in: response.expires_in
      }
    )

Source: GitHub commit 5f8362a

The patch removes access_token, agent_token, and refresh_token fields from the business event payload emitted by the token controller. Parallel changes redact code and token values from the authorize controller across code, id_token, and vp_token response paths.

Detection Methods for CVE-2026-55221

Indicators of Compromise

Business event log entries from Boruta versions below 0.10.0 that contain access_token, refresh_token, agent_token, id_token, or vp_token fields with non-empty values.
Authorization or introspection requests originating from IP addresses that also accessed the log aggregation platform.
Token usage from user agents or geolocations that do not match the original authorization event.

Detection Strategies

Grep or query centralized log stores for JSON keys matching known token field names emitted by the vulnerable controllers.
Correlate token issuance events with subsequent resource server access; flag reuse from unexpected client fingerprints.
Audit access to the Boruta administration log viewer and downstream log pipelines such as Elasticsearch, Loki, or S3 buckets.

Monitoring Recommendations

Alert on any read access to log stores containing pre-patch Boruta events, and treat those tokens as compromised.
Track introspection endpoint activity for tokens issued before the upgrade to 0.10.0.
Monitor refresh token rotations to identify replay from stale credential material recovered from historical logs.

How to Mitigate CVE-2026-55221

Immediate Actions Required

Upgrade Boruta to version 0.10.0 or later on all authorization server instances.
Revoke all access tokens, refresh tokens, authorization codes, and VP tokens issued by vulnerable instances.
Rotate client secrets for any client whose tokens may have appeared in retained logs.
Purge or restrict archived business event logs that contain credential material.

Patch Information

The fix is available in Boruta 0.10.0. The security advisory is published as GHSA-pqwf-v25h-4874. The remediation is implemented in commit 5f8362a, which removes credential fields from the log payloads in the authorize_controller and token_controller modules.

Workarounds

Restrict access to the Boruta administration log viewer to a minimal set of operator accounts.
Apply tight ACLs on log aggregation systems and encrypt log stores at rest.
Shorten access token lifetimes and enable refresh token rotation to reduce the replay window until patching is complete.

bash

# Upgrade Boruta and invalidate outstanding tokens
git -C boruta-server fetch --tags
git -C boruta-server checkout 0.10.0
mix deps.get && mix compile
# Revoke outstanding tokens at the database layer
psql -d boruta -c "DELETE FROM tokens WHERE inserted_at < now();"