Log in Start free

Vulnerability · Published Aug 25, 2026 · Assigned by GitHub_M

CVE-2026-44476Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Medium 6.3

In plain English

A medium-severity improper authentication in doorkeeper-openid_connect from doorkeeper-gem. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-doorkeeper-openid-connectno fix listedDEBIAN-CVE-2026-44476
Debian:13ruby-doorkeeper-openid-connectno fix listedDEBIAN-CVE-2026-44476
Debian:14ruby-doorkeeper-openid-connect1.10.1-1DEBIAN-CVE-2026-44476
RubyGemsdoorkeeper-openid_connect1.10.0GHSA-m6vc-f87m-cc2h
Ubuntu:22.04:LTSruby-doorkeeper-openid-connectno fix listedUBUNTU-CVE-2026-44476
Ubuntu:24.04:LTSruby-doorkeeper-openid-connectno fix listedUBUNTU-CVE-2026-44476
Ubuntu:26.04:LTSruby-doorkeeper-openid-connectno fix listedUBUNTU-CVE-2026-44476

Affected products (as reported)

VendorProductVersions
doorkeeper-gem doorkeeper-openid_connect >= 1.9.0, < 1.10.0

Weakness: CWE-287, CWE-1390 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References