---
id: CVE-2026-70665
title: >-
  Doorkeeper OpenID Connect implements an OpenID Connect authentication provider
  for Rails applications on top of Doorkeeper
summary: >-
  Doorkeeper OpenID Connect implements an OpenID Connect authentication provider
  for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic
  Client Registration (DCR) endpoint persists client-supplied scopes without
  validatin…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-285
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70665'
references:
  - url: >-
      https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/24c3cb1729b69f48649a6f4491dcae69f805000d
    label: security-advisories@github.com
  - url: >-
      https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-8r7r-wh7x-27ff
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00258
epssPercentile: 0.15608
ingestedAt: '2026-09-09T21:22:45.554Z'
---

## Overview

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.