anonhaven

CVE-2026-70665

MEDIUM CVSS 3.1: 4.2
Updated Aug 26, 2026
Rails
Parameter Value
CVSS 4.2 (MEDIUM)
Fixed In 1.10.4
Type CWE-285 (Improper Authorization)
Vendor Rails
Public PoC No

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant.

In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-285 Improper Authorization

References 2

https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/24c3cb1729b6…
security-advisories@github.com
https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories…
security-advisories@github.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-73648

Rails

5.1

CVE-2026-45378

Decidim

7.5

CVE-2026-66066

Rails

9.5

CVE-2026-32825

Rails

7.3

CVE-2026-32823

Rails

4.3