AIKIDO-2026-357719

doorkeeper-openid_connect is vulnerable to Improper Authorization

CVE-2026-70665Published Sep 23, 2026

CVE Score

Medium

Improper Authorization

TL;DR

The Dynamic Client Registration endpoint's DynamicClientRegistrationController#application_params assigns scopes directly from params[:scope] without checking it against Doorkeeper.configuration.scopes. With enforce_configured_scopes off (the default) and no authorize_dynamic_client_registration callback configured, a self registered client can request a scope such as admin that the server never intended to grant, and Doorkeeper's ScopeChecker checks the request against the client's own scopes rather than the server's configured set, so the client can reach the consent screen with privileges beyond what the server intended for dynamically registered clients. The fix persists only registration.permitted_scopes, the intersection with the server's configured default_scopes/optional_scopes, and rejects the registration with invalid_client_metadata when none of the requested scopes are supported.

How do I fix this?

Upgrade the doorkeeper-openid_connect library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you have Dynamic Client Registration enabled without enforce_configured_scopes turned on.