CVE-2026-70665: CWE-285: Improper Authorization in doorkeeper-gem doorkeeper-openid_connect

Doorkeeper OpenID Connect, a Rails authentication provider built on Doorkeeper, improperly authorizes scope assignments during Dynamic Client Registration prior to version 1.10.4. Specifically, the DynamicClientRegistrationController#application_params method assigns the scopes attribute directly from params[:scope] without validating against the server's configured scopes or optional scopes. Because enforce_configured_scopes is off by default and Doorkeeper's ScopeChecker prioritizes application-level scopes, a self-registered client can escalate privileges by obtaining scopes beyond those intended by the server. This vulnerability is addressed in version 1.10.4.

An attacker who self-registers a client can obtain unauthorized scopes, potentially gaining elevated privileges within the OpenID Connect authentication system. The impact is limited to scope escalation and does not directly affect confidentiality or availability. The CVSS score of 4.2 reflects a medium severity with low confidentiality and integrity impact and no availability impact.

Upgrade to doorkeeper-openid_connect version 1.10.4 or later, where this improper authorization issue is fixed. Until upgraded, consider enabling enforce_configured_scopes to enforce scope validation. No other vendor advisory or patch information is provided, so check the official vendor resources for the latest remediation guidance.