CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

• CWE-285

• https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/24c3cb1729b69f48649a6f4491dcae69f805000d
• https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-8r7r-wh7x-27ff

Published

Aug 25, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70653libvips is a fast image processing library with low memory n…4.8
• CVE-2026-70654libvips is a fast image processing library with low memory n…5.8
• CVE-2026-70656Checkmate is an open-source, self-hosted tool designed to tr…4.9
• CVE-2026-70657Copyparty is a portable file server. Prior to 1.20.17, copyp…4.3
• CVE-2026-70658Pay is a payments engine for Ruby on Rails 6.0 and higher. P…7.4
• CVE-2026-7066A vulnerability was found in choieastsea simple-openstack-mc…7.3
• CVE-2026-70666Lemur manages TLS certificate creation. Prior to 1.9.3, an a…7.4
• CVE-2026-70667Lemur manages TLS certificate creation. Prior to 1.9.3, _val…6.3
• CVE-2026-70668Vulnerability in the Oracle Reports Developer product of Ora…9.1
• CVE-2026-70669Vulnerability in the Oracle Reports Developer product of Ora…9.8
• CVE-2026-7067A vulnerability was determined in D-Link DIR-822 A_101. The …7.3
• CVE-2026-70670Vulnerability in the Oracle Reports Developer product of Ora…7.6