The vulnerability is a Server‑Side Request Forgery that occurs when the application dereferences a client‑supplied URI without validating the target. Unauthenticated requests that include a malicious request_uri or jwks_uri cause the server’s HTTP client to fetch that URI. The code does not enforce HTTPS, apply an allowlist, or block non‑public address ranges after DNS resolution, and it does not limit response size or constrain redirects. As a result, an attacker can direct the server to reach any network destination that the host can reach, potentially enabling data exfiltration or further internal network compromise.

The affected product is Boruta Auth from the vendor malach‑it, specifically all releases from version 2.3.2 through 2.3.6 inclusive.

The CVSS score of 6.9 classifies this as moderate severity. The EPSS score is reported as < 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. The attack vector is remote and unauthenticated: an attacker must craft an OAuth authorization request or an OpenID Connect dynamic client registration that contains a malicious URI. Once triggered, the broker initiates an outbound HTTP request to the specified address and follows redirects without size limits, giving attackers a straightforward path to internal hosts or cloud metadata services. Successful exploitation can lead to information disclosure or serve as a foothold for further attacks.