Description

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with access to Boruta logs, log aggregation systems, or the administration log viewer could recover these credentials and use them until expiration or revocation. This issue has been patched in version 0.10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T18:20:10.760Z",
  "pubdate": "2026-09-02T18:20:10.760Z",
  "executiveSummary": "Boruta, an OAuth 2.0 and OpenID Connect authorization server, suffers from an information disclosure vulnerability prior to version 0.10.0.\nThe application improperly logs highly sensitive authentication and authorization artifacts, including access tokens, refresh tokens, authorization codes, and various identity tokens.\nThis vulnerability exposes these credentials within local log files, log aggregation systems, or administrative log viewers, effectively bypassing the security controls intended to protect these tokens.\nThe impact is critical, as an attacker with unauthorized access to these logs can impersonate users or services by hijacking valid session credentials.\nExploitation does not require direct interaction with the authorization server's endpoints, but rather necessitates access to the infrastructure layer where logs are stored or managed.\nThe risk is substantial, as exposed tokens remain valid for the duration of their lifespan unless explicitly revoked, allowing for persistent unauthorized access to protected resources.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of application logging mechanisms within the Boruta authorization server codebase. Instead of sanitizing or omitting sensitive data, the logging sub-system captures full payloads from multiple OAuth 2.0 and OpenID Connect workflows.\nAffected components include the token issuance logic, as well as the introspection and revocation endpoints. Sensitive values explicitly recorded in plain-text logs include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens.\nThe attack flow relies on an attacker gaining read access to the server's logging environment. Because these logs are typically centralized in aggregators like ELK stacks, Splunk, or cloud-based logging services, an attacker who compromises these secondary systems can systematically harvest valid credentials.\nThe exploitation process follows these steps: 1. An attacker identifies or gains access to the storage location of Boruta's business event logs. 2. The attacker performs a search or filter operation to identify entries containing sensitive OAuth/OIDC tokens. 3. The attacker extracts the valid bearer tokens, authorization codes, or refresh tokens from the log data. 4. Using the harvested tokens, the attacker injects them into intercepted HTTP requests to the target protected resources, effectively bypassing authentication by acting as the legitimately authorized entity.\nThe technical severity is elevated because these logs contain long-lived refresh tokens, which an attacker could use to generate new access tokens even after the original access tokens have expired. Since the vulnerability existed across multiple endpoints—including introspection and revocation—it creates a comprehensive exposure of the authorization flow lifecycle.\nThis vulnerability affects all versions of Boruta prior to 0.10.0. The lack of proper sanitization functions for loggable objects or the absence of a redaction middleware allowed these sensitive strings to persist in non-secure, high-visibility storage environments, contrary to the principle of least privilege for log data."
}