CVE-2026-70665

Deferred Deferred - Pending Action

Doorkeeper OpenID Connect Scope Validation Bypass

Publication date: 2026-08-25

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-70665

Affected Vendors & Products

Vendor	Product	Version / Range
doorkeeper	doorkeeper	1.10.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Doorkeeper OpenID Connect is a library for Rails applications that provides OpenID Connect authentication. Prior to version 1.10.4, it had a flaw in the Dynamic Client Registration (DCR) endpoint where client-supplied scopes were saved without checking against the server's allowed scopes. This allowed self-registered clients to gain unauthorized scopes beyond what the server intended.

Detection Guidance

Check the Doorkeeper OpenID Connect gem version in your Rails application. If it is below 1.10.4, the system is vulnerable. Run 'bundle list' or check Gemfile.lock for the version.

Impact Analysis

If you use Doorkeeper OpenID Connect before version 1.10.4, an attacker could register a malicious client application and request elevated permissions. This could lead to unauthorized access to protected resources or data, depending on the misconfigured scopes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized scope escalation risks exposing personal or protected health information.

Mitigation Strategies

Upgrade Doorkeeper OpenID Connect to version 1.10.4 or later. Update the gem in your Gemfile and run 'bundle update doorkeeper-openid_connect'.

Hi! I’m here to help you understand CVE-2026-70665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70