malach-it boruta

• CVE-2026-53431 Critical 9.1 Boruta accepts expired JWT client assertions due to missing exp claim validation 0.5%
• CVE-2026-65635 High 8.3 Boruta dynamic client registration allows creation of over-privileged OAuth clients 0.4%
• CVE-2026-54885 Medium 6.9 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching 0.5%