CVE-2019-9837: Medium severity openid connect vulnerability
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9837?
CVE-2019-9837 is considered a high severity vulnerability due to its potential to facilitate phishing attacks.
How do I fix CVE-2019-9837?
To fix CVE-2019-9837, upgrade the Doorkeeper::OpenidConnect extension to version 1.5.4 or later.
What impact does CVE-2019-9837 have on my application?
CVE-2019-9837 allows attackers to exploit open redirects via the redirect_uri field, potentially leading to phishing risks.
Which versions of Doorkeeper::OpenidConnect are affected by CVE-2019-9837?
CVE-2019-9837 affects Doorkeeper::OpenidConnect versions 1.4.x and 1.5.x prior to 1.5.4.
Is CVE-2019-9837 specific to certain environments?
CVE-2019-9837 is not limited to specific environments and can affect any application using vulnerable versions of the Doorkeeper::OpenidConnect extension.