{"id":"CVE-2023-34246","aliases":["DEBIAN-CVE-2023-34246","DLA-3494-1","DLA-3989-1","EUVD-2023-1739","GHSA-7w2c-w47h-789w","UBUNTU-CVE-2023-34246","USN-6210-1"],"status":"published","title":"Doorkeeper Improper Authentication vulnerability","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00716,"percentile":0.5421,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2023-06-12T16:33:05Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"RubyGems","package":"doorkeeper","fixed_in":["5.6.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-doorkeeper","fixed_in":["5.5.0-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-doorkeeper","fixed_in":["5.6.6-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-doorkeeper","fixed_in":["5.6.6-2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-doorkeeper","fixed_in":["4.4.2-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"ruby-doorkeeper","fixed_in":["5.3.0-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-doorkeeper","fixed_in":["2.2.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-doorkeeper","fixed_in":["4.3.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ruby-doorkeeper","fixed_in":["5.0.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-doorkeeper","fixed_in":["5.5.0-2ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-2+deb12u1"}]}],"versions":["5.5.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.6-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.6-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-1+deb10u1"}]}],"versions":["4.4.2-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-2+deb11u1"}]}],"versions":["5.3.0-2"]},{"source":"osv","ecosystem":"RubyGems","package":"doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.6"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.5.0","0.5.0.rc1","0.6.0","0.6.0.rc1","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","1.0.0","1.0.0.rc1","1.0.0.rc2","1.1.0","1.2.0","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","2.0.0","2.0.0.alpha1","2.0.0.rc2","2.0.0.rc3","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","3.0.0","3.0.0.rc1","3.0.0.rc2","3.0.1","3.1.0","4.0.0","4.0.0.rc1","4.0.0.rc2","4.0.0.rc3","4.0.0.rc4","4.1.0","4.2.0","4.2.5","4.2.6","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1","4.4.2","4.4.3","5.0.0","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.2","5.0.3","5.1.0","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.2.0","5.2.0.rc1","5.2.0.rc2","5.2.0.rc3","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.3.0","5.3.1","5.3.2","5.3.3","5.4.0","5.4.0.rc1","5.4.0.rc2","5.5.0","5.5.0.rc1","5.5.0.rc2","5.5.1","5.5.2","5.5.3","5.5.4","5.6.0","5.6.0.rc1","5.6.0.rc2","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1ubuntu0.1~esm1"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1ubuntu0.1~esm1"}]}],"versions":["4.2.0-3","4.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-2ubuntu0.1"}]}],"versions":["4.4.2-1","5.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-2ubuntu0.22.04.1"}]}],"versions":["5.3.0-2","5.5.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1ubuntu0.1~esm1"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1ubuntu0.1~esm1"}]}],"versions":["4.2.0-3","4.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-2ubuntu0.1"}]}],"versions":["4.4.2-1","5.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-doorkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-2ubuntu0.22.04.1"}]}],"versions":["5.3.0-2","5.5.0-2"]}],"products":[{"vendor":"doorkeeper-gem","product":"doorkeeper"},{"vendor":"doorkeeper_project","product":"doorkeeper"}],"references":[{"url":"https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper/issues/1589","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper/pull/1646","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc8252#section-8.6","tags":["x_refsource_MISC","x_transferred","Technical Description","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00010.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34246","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7w2c-w47h-789w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34246.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-34246","tags":["advisory"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-34246","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6210-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-34246","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-34246","title":"Doorkeeper Improper Authentication vulnerability","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","status":"published","published":"2023-06-12T16:33:05.704Z","modified":"2025-02-13T16:55:25.344Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:35.912488Z"}],"euvd":[{"id":"EUVD-2023-1739","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","status":"published","published":"2023-06-12T16:33:05Z","modified":"2025-02-13T16:55:25Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:50.021705Z"}],"ghsa":[{"id":"GHSA-7w2c-w47h-789w","title":"Doorkeeper Improper Authentication vulnerability","description":"OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n\u003e the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646","status":"published","published":"2023-06-12T19:50:34Z","modified":"2024-12-09T06:30:56Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2023-34246","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","status":"published","published":"2023-06-12T17:15:09.967Z","modified":"2026-06-17T06:03:12.91Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"CVE-2023-34246","title":"Doorkeeper Improper Authentication vulnerability","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","status":"published","published":"2023-06-12T16:33:05.704Z","modified":"2026-10-28T02:30:44.629402091Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"DEBIAN-CVE-2023-34246","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","status":"published","published":"2023-06-12T17:15:09.967Z","modified":"2026-10-26T18:02:18.245657855Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-7w2c-w47h-789w","title":"Doorkeeper Improper Authentication vulnerability","description":"OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n\u003e the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646","status":"published","published":"2023-06-12T19:50:34Z","modified":"2026-09-10T03:50:02.18770039Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"UBUNTU-CVE-2023-34246","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.","status":"published","published":"2023-06-12T17:15:00Z","modified":"2026-02-04T04:04:12.623129Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"DLA-3494-1","title":"ruby-doorkeeper - security update","status":"published","published":"2023-07-12T00:00:00Z","modified":"2026-03-09T01:22:38.116361Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3989-1","title":"ruby-doorkeeper - security update","status":"published","published":"2024-12-09T00:00:00Z","modified":"2026-03-09T01:18:06.982297Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"USN-6210-1","title":"ruby-doorkeeper vulnerability","description":"It was discovered that Doorkeeper incorrectly performed authorization checks\nfor public clients that have been previous approved. An attacker could\npotentially exploit these in order to impersonate another user and obtain\nsensitive information.\n","status":"published","published":"2023-07-07T15:14:15Z","modified":"2026-06-25T13:32:10.812692877Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}