CVE-2026-53661

Name of the Vulnerable Software and Affected Versions Boruta versions prior to 0.9.1

Description Boruta is a standalone authorization server implementing OAuth 2.0 and Openid Connect. Session cookies and the identity remember-me cookie were configured without the Secure attribute, which allows browsers to transmit them over unencrypted plaintext HTTP connections if the origin is accessible via HTTP. An attacker intercepting this network traffic could recover the boruta web key shared session cookie or the boruta identity web user remember me cookie to impersonate users. This issue affects the boruta web, boruta identity, and boruta admin components.

Recommendations Update to version 0.9.1 or later. Terminate or reject plaintext HTTP before requests reach the server. Enforce HTTPS-only access at the reverse proxy or load balancer. Enable HSTS for Boruta domains. If cookie exposure is suspected, rotate SECRET KEY BASE and BORUTA SESSION COOKIE SIGNING SALT, then require users to re-authenticate.