doorkeeper-gem vulnerabilities and threats

CVE-2026-44476 is an improper authentication vulnerability in the doorkeeper-openid_connect gem version 1.9.0. It allows an attacker who knows a dynamically registered client's client_id to obtain an access token without providing the client_secret. This occurs because dynamically registered clients are incorrectly marked as non-confidential, causing the client_secret verification to be skipped. The issue affects only projects that have enabled Dynamic Client Registration, which is disabled by default. The vulnerability is fixed in version 1.10.0.

Doorkeeper OpenID Connect versions prior to 1.10.4 have an improper authorization vulnerability in the Dynamic Client Registration endpoint. The endpoint accepts client-supplied scopes without validating them against the server's configured scopes, allowing self-registered clients to obtain unauthorized scopes. This privilege escalation is due to the scopes attribute being assigned directly from user input without validation, combined with default configuration settings that do not enforce scope restrictions. The issue is fixed in version 1.10.4.