CVE catalog

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists cli

[CVE catalog]

Severity
Medium · CVSS 4.2CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.26% · Oct 25, 2026

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-doorkeeper-openid-connectsid2.0.0-1fixed
Debianruby-doorkeeper-openid-connectforky2.0.0-1fixed
Debianruby-doorkeeper-openid-connecttrixie1.8.7-1vulnerable
Debianruby-doorkeeper-openid-connectbookworm1.8.0-1vulnerable
Ubunturuby-doorkeeper-openid-connect18.041.1.2-1vulnerable
Ubunturuby-doorkeeper-openid-connect20.041.5.5-1vulnerable
Ubunturuby-doorkeeper-openid-connect20.041.6.3-2vulnerable
Ubunturuby-doorkeeper-openid-connect22.041.7.4-2vulnerable
Ubunturuby-doorkeeper-openid-connect22.041.8.0-1vulnerable
Ubunturuby-doorkeeper-openid-connect24.041.8.7-1vulnerable
Ubunturuby-doorkeeper-openid-connect26.041.8.7-1vulnerable
Ubunturuby-doorkeeper-openid-connect26.041.8.11-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-doorkeeper-openid-connectsourcesid1.10.5-1not yet assignedNot reportedNot reported
Debianruby-doorkeeper-openid-connectsourceforky1.10.5-1not yet assignedNot reportedNot reported
Debianruby-doorkeeper-openid-connectsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianruby-doorkeeper-openid-connectsourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] ruby-doorkeeper-openid-connect: Minor issue [bookworm] ruby-doorkeeper-openid-connect: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-doorkeeper-openid-connect]Affected
    Details (2)

    • 1.8.0-1 · all · bookworm

      Affected

      nvd · ruby-doorkeeper-openid-connect · debian · bookworm; nvd · ruby-doorkeeper-openid-connect · debian · 12

    • 1.8.0-1 · all · bookworm

      Affected

      nvd · ruby-doorkeeper-openid-connect · debian · bookworm; nvd · ruby-doorkeeper-openid-connect · debian · 12

[Debian 13 (Trixie)]

  • [ruby-doorkeeper-openid-connect]Affected
    Details (2)

    • 1.8.7-1 · all · trixie

      Affected

      nvd · ruby-doorkeeper-openid-connect · debian · 13

    • 1.8.7-1 · all · trixie

      Affected

      nvd · ruby-doorkeeper-openid-connect · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]