CVE-2026-55221: Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden

Boruta is an authorization server (a system that manages who gets access to applications) that implements OAuth 2.0 and OpenID Connect (protocols for secure login and permission handling). Before version 0.10.0, Boruta accidentally logged sensitive tokens (secret credentials like access tokens and ID tokens) in its business event logs, allowing attackers with access to these logs to steal the tokens and impersonate users until the tokens expired or were manually revoked.