Log in Start free

Vulnerability · Published Aug 25, 2026 · Assigned by GitHub_M

CVE-2026-70665Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Medium 4.2

In plain English

A medium-severity security flaw in doorkeeper-openid_connect from doorkeeper-gem. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.3%top 82.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-doorkeeper-openid-connectno fix listedDEBIAN-CVE-2026-70665
Debian:13ruby-doorkeeper-openid-connectno fix listedDEBIAN-CVE-2026-70665
Debian:14ruby-doorkeeper-openid-connect1.10.5-1DEBIAN-CVE-2026-70665
Ubuntu:22.04:LTSruby-doorkeeper-openid-connectno fix listedUBUNTU-CVE-2026-70665
Ubuntu:24.04:LTSruby-doorkeeper-openid-connectno fix listedUBUNTU-CVE-2026-70665
Ubuntu:26.04:LTSruby-doorkeeper-openid-connectno fix listedUBUNTU-CVE-2026-70665

Affected products (as reported)

VendorProductVersions
doorkeeper-gem doorkeeper-openid_connect < 1.10.4

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References