Executive brief
A vulnerability in the Doorkeeper OpenID Connect extension allows unauthorized access to applications that use the Dynamic Client Registration feature. This feature incorrectly creates new client accounts as 'public' even when they are assigned a secret password, meaning the system does not actually verify that password during login. An attacker who knows a client's public ID can impersonate that client and obtain access tokens without needing their private secret.
Technical details
The DynamicClientRegistrationController#register action in doorkeeper-openid_connect v1.9.0 hard-codes 'confidential: false' when creating new applications. While the response includes a client_secret and advertises support for secret-based authentication methods, Doorkeeper's underlying logic treats missing or blank secrets as valid for non-confidential (public) clients. Consequently, an attacker can perform a client_credentials grant at the token endpoint using only a known client_id, bypassing secret verification entirely. This issue affects only projects where the opt-in Dynamic Client Registration feature is enabled. The vulnerability is patched in version 1.10.0.
Affected products
- doorkeeper-gem doorkeeper-openid_connect 1.9.0
Timeline
- 2026-06-01: disclosed
- 2026-06-04: advisory: GitHub Advisory published
- 2026-06-04: patched: Version 1.10.0 released