CVE catalog

CVE-2019-9837

ruby-doorkeeper-openid-connect: CVE-2019-9837

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.35% · Oct 25, 2026

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-doorkeeper-openid-connectsid2.0.0-1fixed
Debianruby-doorkeeper-openid-connectforky2.0.0-1fixed
Debianruby-doorkeeper-openid-connecttrixie1.8.7-1fixed
Debianruby-doorkeeper-openid-connectbookworm1.8.0-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-doorkeeper-openid-connectsourcesid1.5.5-1not yet assignedNot reported[924747]
Debianruby-doorkeeper-openid-connectsourceforky1.5.5-1not yet assignedNot reported[924747]
Debianruby-doorkeeper-openid-connectsourcetrixie1.5.5-1not yet assignedNot reported[924747]
Debianruby-doorkeeper-openid-connectsourcebookworm1.5.5-1not yet assignedNot reported[924747]

[Debian bug #924747]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-doorkeeper-openid-connect]Fixed
    Details (2)

    • 1.8.0-1 · all · bookworm

      Fixed · Fixed: 1.5.5-1

      dsa · ruby-doorkeeper-openid-connect · debian · bookworm; dsa · ruby-doorkeeper-openid-connect · debian · 12

    • 1.8.0-1 · all · bookworm

      Fixed · Fixed: 1.5.5-1

      dsa · ruby-doorkeeper-openid-connect · debian · bookworm; dsa · ruby-doorkeeper-openid-connect · debian · 12

[Debian 13 (Trixie)]

  • [ruby-doorkeeper-openid-connect]Fixed
    Details (2)

    • 1.8.7-1 · all · trixie

      Fixed · Fixed: 1.5.5-1

      dsa · ruby-doorkeeper-openid-connect · debian · 13

    • 1.8.7-1 · all · trixie

      Fixed · Fixed: 1.5.5-1

      dsa · ruby-doorkeeper-openid-connect · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]