{"id":"CVE-2026-44476","aliases":["DEBIAN-CVE-2026-44476","EUVD-2026-66188","GHSA-m6vc-f87m-cc2h","UBUNTU-CVE-2026-44476"],"status":"published","title":"Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00564,"percentile":0.4735,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1390","CWE-287","CWE-290"],"published":"2026-06-04T14:37:11Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"RubyGems","package":"doorkeeper-openid_connect","fixed_in":["1.10.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"ruby-doorkeeper-openid-connect","fixed_in":["1.10.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"doorkeeper-openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"last_affected":"1.9.0"},{"fixed":"1.10.0"}]}],"versions":["1.9.0"]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1","1.10.5-1","1.8.0-1","1.8.11-1","1.8.11-2","1.8.5-1","1.8.5-2","1.8.7-1","1.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1","1.10.5-1","1.8.11-1","1.8.11-2","1.8.7-1","1.9.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1"}]}],"versions":["1.8.11-1","1.8.11-2","1.8.7-1","1.9.0-1"]},{"source":"osv","ecosystem":"RubyGems","package":"doorkeeper-openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.10.0"}]}],"versions":["1.9.0"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.5-1","1.6.3-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4-2","1.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-doorkeeper-openid-connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.7-1","1.8.11-1"]}],"products":[{"vendor":"doorkeeper-gem","product":"doorkeeper-openid_connect"}],"references":[{"url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-m6vc-f87m-cc2h","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/561af83dcf","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases/tag/v1.10.0","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper-openid_connect/CVE-2026-44476.yml","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44476","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-m6vc-f87m-cc2h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44476.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44476","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44476","tags":["advisory"]},{"url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-44476","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-44476","title":"Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","status":"published","published":"2026-08-25T22:47:54.774Z","modified":"2026-08-26T15:38:48.102Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287","CWE-1390"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-66188","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","status":"published","published":"2026-08-25T22:47:54Z","modified":"2026-08-26T15:38:48Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:30.542287Z"}],"ghsa":[{"id":"GHSA-m6vc-f87m-cc2h","title":"Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret","description":"### Impact\n\nThe `DynamicClientRegistrationController#register` action hard-codes `confidential: false` when creating applications (dynamic_client_registration_controller.rb:18-25), yet the response includes a client_secret and advertises `token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"]`.\n\nBecause Doorkeeper's `Application.by_uid_and_secret` treats a blank/missing secret as valid for non-confidential (public) clients, an\nattacker who knows only the client_id (which is public information) can authenticate as the dynamically-registered client at the token endpoint.\n\n**Note** that Dynamic Client Registration is opt-in feature which is disabled by default so only projects that explicitly enabled it are affected.\n\n**Steps to Reproduce**\n\n1. Enable dynamic client registration in the initializer\n2. POST /oauth/registration with client_name, redirect_uris, and scope\n3. Observe: response returns client_secret, but the created\nDoorkeeper::Application has confidential: false\n4. Call `Doorkeeper::Application.by_uid_and_secret(client_id, nil)` — it\nreturns the application (credentials bypass)\n5. POST /oauth/token with grant_type=client_credentials and only\nclient_id (no client_secret) — the token endpoint issues an access token\nwithout any secret verification\n\n\n### Patches\nPatched in 1.10.0\n\n### Workarounds\nUpgrade existing applications created with a Dynamic Client registration to have `confidential: true`","status":"published","published":"2026-06-04T14:37:11Z","modified":"2026-06-09T11:57:56Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-44476","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","status":"published","published":"2026-08-25T23:17:04.4Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-287","CWE-1390"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-44476","title":"Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","status":"published","published":"2026-08-25T22:47:54.774Z","modified":"2026-10-28T02:30:39.311914775Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1390","CWE-287"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"DEBIAN-CVE-2026-44476","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","status":"published","published":"2026-08-25T23:17:04.4Z","modified":"2026-10-01T03:03:13.793117491Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-m6vc-f87m-cc2h","title":"Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret","description":"### Impact\n\nThe `DynamicClientRegistrationController#register` action hard-codes `confidential: false` when creating applications (dynamic_client_registration_controller.rb:18-25), yet the response includes a client_secret and advertises `token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"]`.\n\nBecause Doorkeeper's `Application.by_uid_and_secret` treats a blank/missing secret as valid for non-confidential (public) clients, an\nattacker who knows only the client_id (which is public information) can authenticate as the dynamically-registered client at the token endpoint.\n\n**Note** that Dynamic Client Registration is opt-in feature which is disabled by default so only projects that explicitly enabled it are affected.\n\n**Steps to Reproduce**\n\n1. Enable dynamic client registration in the initializer\n2. POST /oauth/registration with client_name, redirect_uris, and scope\n3. Observe: response returns client_secret, but the created\nDoorkeeper::Application has confidential: false\n4. Call `Doorkeeper::Application.by_uid_and_secret(client_id, nil)` — it\nreturns the application (credentials bypass)\n5. POST /oauth/token with grant_type=client_credentials and only\nclient_id (no client_secret) — the token endpoint issues an access token\nwithout any secret verification\n\n\n### Patches\nPatched in 1.10.0\n\n### Workarounds\nUpgrade existing applications created with a Dynamic Client registration to have `confidential: true`","status":"published","published":"2026-06-04T14:37:11Z","modified":"2026-06-09T12:00:16.158054391Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"UBUNTU-CVE-2026-44476","description":"Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.","status":"published","published":"2026-08-25T23:17:00Z","modified":"2026-09-02T19:34:27.427579164Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:22.075798Z"}]}}