AIKIDO-2026-285271

doorkeeper is vulnerable to Improper Authentication

Improper Authentication Pre-CVE Published Aug 21, 2026

Medium Risk

This Affects:

doorkeeper

0.4.0 - 5.9.5

Fixed in 5.9.6

Are you affected? Scan for Free

TL;DR

The OAuth client credential extractor in credentials.rb runs multiple extraction methods in order and returns the first identity it finds. When a request presents conflicting client identities, such as an Authorization: Basic header for one client and a client_id parameter naming another, the server silently authenticates as the first identity and discards the second. This lets a request be processed under a different client identity than parts of the same request declare, causing authentication and authorization confusion. The fix rejects requests whose extracted credentials resolve to different client UIDs with an invalid_request error while still allowing a matching client_id alongside another method for the same client.

Who does this affect?

You are affected if you run a Doorkeeper OAuth provider in a version within the vulnerable range and any part of your application, authorization layer, or audit logging relies on the client_id a request declares rather than the client identity Doorkeeper authenticates. A request presenting two conflicting client identities (for example an Authorization: Basic header for one client and a client_id parameter naming another) is processed as the first extracted identity while the second is silently discarded, so components that trust the declared client_id can diverge from the authenticated client.