Privilege Escalation Vulnerability in Doorkeeper OpenID Connect for Rails Applications

CVE-2026-70665

What is CVE-2026-70665?

The Doorkeeper OpenID Connect authentication provider for Rails applications allows unauthorized scope privileges due to inadequate validation of client-supplied scopes in the Dynamic Client Registration (DCR) endpoint. Before version 1.10.4, the application failed to verify the supplied scopes against the server's configured scope set, enabling a self-registered client to potentially access permissions not intended by the server. This vulnerability arises from the absence of checks in the DynamicClientRegistrationController#application_params method, where the 'scopes' attribute is directly assigned without validation. Furthermore, the default configuration for enforce_configured_scopes is off, allowing the ScopeChecker to prioritize application-level scopes over more restrictive server-level scopes, leading to a potential privilege escalation. This flaw emphasizes the importance of stringent scope validation in OAuth implementations.

References