The flaw arises because the MAlach‑IT Boruta OpenID Connect implementation forwards all caller‑supplied registration data straight into the administrative client‑creation routine without any field‑level filtering. As a result, an unauthenticated user can submit parameters that set security–critical attributes such as grant types, scopes, PKCE enforcement, token lifetimes and signing configurations. The vulnerability is classified as CWE‑653 (Improper Constraint on Privileged Attributes). If exploited, the attacker could create a client that effectively has operator‐level access to the OAuth infrastructure, potentially facilitating token issuance, impersonation, or other privileged actions. The impact therefore lies in privilege escalation within the Authorization Server.

This issue affects the MAlach‑IT Boruta library, specifically versions from 2.3.0 up to, but not including, 2.3.7. The vulnerable code resides in lib/boruta/openid.ex and the register_client/3 and parse_registration_params/2 routines of the Elixir.Boruta.Openid module.

The CVSS score is 8.3, indicating high severity, and the EPSS score is approximately 0.3%, showing a low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting it has not been widely exploited publicly. The likely attack vector is remote over the network, where an unauthenticated caller can issue a registration request to the dynamic client registration endpoint. Because the flaw permits arbitrary privilege assignment, the exploitation complexity is low and the potential impact is significant, warranting prompt remediation.