CVE-2026-53661: boruta-server sent sensitive session cookies without the Secure attribute

Synopsis

This is a session cookie misconfiguration in boruta-server, an open-source OAuth 2.0 and OpenID Connect authorization server. The affected application set session cookies and a remember-me cookie without the Secure attribute, meaning browsers could transmit them over unencrypted HTTP connections when that path was reachable. An attacker who can observe or intercept plaintext HTTP traffic recovers a valid session or remember-me cookie and uses it to impersonate the affected user. No fix version has been published to a release yet, though the patch exists in commit 18691c655164635066aa113003a3cd87f6ed11cd; HarborGuard is tracking the advisory for the moment an official release becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned to observe or intercept HTTP traffic between the user's browser and the Boruta origin, meaning the service must be reachable over the network on a plaintext HTTP path.

• AuthenticationNot required

  No account or credentials are needed to exploit this; the attacker only needs passive access to the network traffic carrying the cookie.

• Victim interactionNot required

  No victim action is required beyond the user making a normal authenticated request over a plaintext HTTP connection that the attacker can see.

• Attack complexityDetail

  The exploit is reliable and condition-free once the plaintext HTTP path is reachable; no race condition or special environmental setup is required.

Blast Radius

• An attacker reads a valid session cookie (_boruta_web_key) or remember-me cookie (_boruta_identity_web_user_remember_me) from intercepted HTTP traffic.
• The recovered cookie is replayed to impersonate the affected user against boruta_web, boruta_identity, or boruta_admin without supplying credentials.
• Because boruta-server acts as an OAuth 2.0 and OpenID Connect provider, a hijacked admin or privileged session extends impersonation reach to downstream applications that trust tokens issued by this server.