CVE-2026-70665: Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes
Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#applicationparams, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optionalscopes. Combined with enforceconfiguredscopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Doorkeeper OpenID Connectto a version that resolves this vulnerability.Fixed in 1.10.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Doorkeeper OpenID Connect before version 1.10.4 with Dynamic Client Registration available are affected. The privilege-escalation path is particularly relevant when enforce_configured_scopes is left disabled, which is the default.
What must an attacker do to exploit the issue?
An attacker must be able to self-register a client through the Dynamic Client Registration endpoint and supply scopes during registration. The vulnerable endpoint stores those requested scopes without checking them against the server's configured or optional scopes.
Why can unvalidated registration scopes result in elevated access?
Doorkeeper's ScopeChecker prioritizes scopes assigned to an application over the server-level scope configuration. A self-registered application's persisted scopes can therefore be used to request permissions the server did not intend to grant.
How can I determine whether my installation is affected?
Check whether the installed Doorkeeper OpenID Connect version is earlier than 1.10.4, whether the Dynamic Client Registration endpoint permits self-registration, and whether enforce_configured_scopes is disabled. Also review registered clients for scopes that are not part of the server's configured scope set.
What is the remediation?
Upgrade Doorkeeper OpenID Connect to version 1.10.4. If an immediate upgrade is not possible, enabling enforce_configured_scopes can reduce exposure by enforcing the configured scope set.