AIKIDO-2026-357719

doorkeeper-openid_connect is vulnerable to Improper Authorization

Improper AuthorizationCVE-2026-70665 Published 2 days ago

Medium Risk

This Affects:

doorkeeper-openid_connect

0.0.1 - 1.10.3

Fixed in 1.10.4

Are you affected? Scan for Free

TL;DR

The Dynamic Client Registration endpoint's DynamicClientRegistrationController#application_params assigns scopes directly from params[:scope] without checking it against Doorkeeper.configuration.scopes. With enforce_configured_scopes off (the default) and no authorize_dynamic_client_registration callback configured, a self registered client can request a scope such as admin that the server never intended to grant, and Doorkeeper's ScopeChecker checks the request against the client's own scopes rather than the server's configured set, so the client can reach the consent screen with privileges beyond what the server intended for dynamically registered clients. The fix persists only registration.permitted_scopes, the intersection with the server's configured default_scopes/optional_scopes, and rejects the registration with invalid_client_metadata when none of the requested scopes are supported.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you have Dynamic Client Registration enabled without enforce_configured_scopes turned on.