Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

doorkeeper-openid_connect

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3RubyGemsPublished

    Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret

    CVE-2026-44476 · GHSA-m6vc-f87m-cc2h

    Affected
    • RubyGems doorkeeper-openid_connect >= 1.9.0, <= 1.9.0
    Fixed in
    1.10.0· Vendor fix available
    Issue
    Impact The DynamicClientRegistrationController#register action hard-codes confidential: false when creating applications (dynamicclientregistrationcontroller.rb:18-25), yet the response includes a clientsecret and advertises tokenendpointauthmethodssupported: ["clientsecretbasic", "clientsecretpost"]. Because Doorkeeper's Application.byuidandsecret treats a blank/missing secret as valid for non-confidential (public) clients, an attacker who knows only the clientid (which is public information) can authenticate as the dynamically-registered client at the token endpoint. Note that Dynamic Client Registration is opt-in feature which is disabled by default so only projects that explicitly enabled it are affected. Steps to Reproduce 1. Enable dynamic client registration in the initializer 2. POST /oauth/registration with clientname, redirecturis, and scope 3. Observe: response returns clientsecret, but the created Doorkeeper::Application has confidential: false 4. Call…

    Recommended action: Upgrade to 1.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.1RubyGemsPublished

    Doorkeeper-openid_connect contains Open Redirect

    CVE-2019-9837 · GHSA-vv4c-g6q7-p3q7

    Affected
    • RubyGems doorkeeper-openid_connect >= 1.4.0, < 1.5.4
    Fixed in
    1.5.4· Vendor fix available
    Issue
    Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.

    Recommended action: Upgrade to 1.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →