CVE-2026-70665 doorkeeper-gem CVE debrief

Who should care

Defenders responsible for OpenID Connect implementations using Doorkeeper OpenID Connect should assess exposure and take remediation steps. This includes verifying if the implementation uses a vulnerable version of Doorkeeper OpenID Connect, upgrading to version 1.10.4 or later if vulnerable, and restricting client-supplied scopes to prevent unauthorized access. Additionally, defenders should review compensating controls for exposed systems while and

Why it matters

CVE-2026-70665 is a medium-severity vulnerability in Doorkeeper OpenID Connect that allows self-registered clients to obtain excessive scopes, potentially leading to unauthorized access and data compromise. Defenders should verify exposure, upgrade to version 1.10.4 if vulnerable, and restrict client-supplied scopes.

• Potential unauthorized access to protected resources due to excessive scopes granted to self-registered clients.
• Need to verify and restrict client-supplied scopes to prevent privilege escalation.
• Possible impact on the confidentiality and integrity of user data.

Technical summary

The Dynamic Client Registration (DCR) endpoint in Doorkeeper OpenID Connect does not validate client-supplied scopes against the server's configured scope set, allowing a self-registered client to obtain scopes beyond what the server intended to grant. This issue is fixed in version 1.10.4. The vulnerability arises from the assignment of scopes directly from params[:scope] without validation against Doorkeeper.configuration.scopes or optional_scopes in DynamicClientRegistrationController#application_params. This allows self-registered clients to obtain scopes beyond what the server intended to grant, potentially leading to unauthorized access and data compromise.

Defensive priority

Defenders should prioritize verifying exposure in their OpenID Connect implementations and upgrading to version 1.10.4 if vulnerable.

Recommended defensive actions

• Verify if the OpenID Connect implementation uses a vulnerable version of Doorkeeper OpenID Connect.
• Upgrade to version 1.10.4 or later if vulnerable.
• Review and restrict client-supplied scopes to prevent unauthorized access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. Additional information on affected deployments is limited; defenders should verify exposure in their OpenID Connect implementations using Doorkeeper OpenID Connect and review client-supplied scopes to prevent unauthorized access. The Dynamic Client Registration (DCR) endpoint's lack of validation on client-supplied scopes allows self-registered clients to obtain scopes beyond what the server intended to grant. This issue is fixed in version 1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.