Read the docs
TI-2026-49360 Aliases CVE-2026-70665

Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Priority LOW 19CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix Fixed doorkeeper-openid_connect (doorkeeper-gem): 1.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
doorkeeper-gemdoorkeeper-openid_connectbefore 1.10.41.10.4Patch availableCNA
  • doorkeeper-openid_connect Vendordoorkeeper-gem Affected before 1.10.4 Fixed in 1.10.4 Patch available CNA

Remediation

  • Fix · CNA doorkeeper-openid_connect (doorkeeper-gem) Fixed in 1.10.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70665

References

Other 2

  • TI-2026-32415 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences