Is CVE-2026-44476 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44476 being exploited in the wild.

How severe is CVE-2026-44476?

Medium severity, with a CVSS score of 4, published 25 August 2026.

Which products and versions are affected?

doorkeeper-openid_connect (RubyGems) = 1.9.0, ECOSYSTEM:introduced=1.9.0,fixed=1.10.0.

Is there a fix for CVE-2026-44476?

Yes. doorkeeper-openid_connect (RubyGems): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44476 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44476?

Check whether you run Doorkeeper OpenID Connect or doorkeeper-openid_connect (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44476: Doorkeeper OpenID Connect authentication bypass in Dynamic Client Registration

CVE-2026-44476 · Severity: medium · CVSS 4 · Published 2026-08-25

A vulnerability in the Doorkeeper OpenID Connect extension allows unauthorized access to applications that use the Dynamic Client Registration feature. This feature incorrectly creates new client accounts as 'public' even when they are assigned a secret password, meaning the system does not actually verify that password during login. An attacker who knows a client's public ID can impersonate that client and obtain access tokens without needing their private secret.

Technologies: doorkeeper-openid_connect (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-44476 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44476 being exploited in the wild.
How severe is CVE-2026-44476?: Medium severity, with a CVSS score of 4, published 25 August 2026.
Which products and versions are affected?: doorkeeper-openid_connect (RubyGems) = 1.9.0, ECOSYSTEM:introduced=1.9.0,fixed=1.10.0.
Is there a fix for CVE-2026-44476?: Yes. doorkeeper-openid_connect (RubyGems): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44476 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44476?: Check whether you run Doorkeeper OpenID Connect or doorkeeper-openid_connect (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

doorkeeper-openid_connect (RubyGems): upgrade to 1.10.0 or later
```
bundle update doorkeeper-openid_connect
```

Technical details

The DynamicClientRegistrationController#register action in doorkeeper-openid_connect v1.9.0 hard-codes 'confidential: false' when creating new applications. While the response includes a client_secret and advertises support for secret-based authentication methods, Doorkeeper's underlying logic treats missing or blank secrets as valid for non-confidential (public) clients. Consequently, an attacker can perform a client_credentials grant at the token endpoint using only a known client_id, bypassing secret verification entirely. This issue affects only projects where the opt-in Dynamic Client Registration feature is enabled. The vulnerability is patched in version 1.10.0.

Affected products

doorkeeper-gem doorkeeper-openid_connect 1.9.0

Identifiers

CVE-2026-44476
GHSA-m6vc-f87m-cc2h

Timeline

2026-06-01: disclosed
2026-06-04: advisory: GitHub Advisory published
2026-06-04: patched: Version 1.10.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.