Is CVE-2026-70665 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70665 being exploited in the wild.

How severe is CVE-2026-70665?

Medium severity, with a CVSS score of 4.2, published 25 August 2026.

Which products and versions are affected?

doorkeeper-gem Doorkeeper OpenID Connect prior to 1.10.4.

Is there a fix for CVE-2026-70665?

A patch was published on 2026-07-02: version 1.10.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70665 attacked?

It is attacked over the network.

Am I affected by CVE-2026-70665?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70665: Doorkeeper OpenID Connect scope validation bypass in Dynamic Client Registration

CVE-2026-70665 · Severity: medium · CVSS 4.2 · Published 2026-08-25

Doorkeeper OpenID Connect is a Ruby gem that adds OpenID Connect authentication to Rails applications. The Dynamic Client Registration endpoint allows applications to self-register and request OAuth scopes, but prior to version 1.10.4 it failed to validate requested scopes against the server's configured list. An attacker could register a malicious client claiming administrative or other privileged scopes, then obtain tokens with those unintended permissions, effectively elevating their access beyond what the server intended to grant.

Quick answers

Is CVE-2026-70665 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70665 being exploited in the wild.
How severe is CVE-2026-70665?: Medium severity, with a CVSS score of 4.2, published 25 August 2026.
Which products and versions are affected?: doorkeeper-gem Doorkeeper OpenID Connect prior to 1.10.4.
Is there a fix for CVE-2026-70665?: A patch was published on 2026-07-02: version 1.10.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70665 attacked?: It is attacked over the network.
Am I affected by CVE-2026-70665?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authorization / scope validation flaw in the Dynamic Client Registration (DCR) endpoint. In DynamicClientRegistrationController#application_params, user-supplied scope parameters are persisted directly without validation against Doorkeeper.configuration.scopes or optional_scopes. The issue is compounded because enforce_configured_scopes is off by default, and Doorkeeper's ScopeChecker prioritizes application-level scopes over server-level scopes during token issuance. This allows an unauthenticated attacker to self-register a client with arbitrary scopes (e.g., "admin") and later obtain tokens claiming those privileges. The fix in v1.10.4 validates DCR-supplied scopes against the server's configured scope set, silently dropping unrecognized ones and rejecting requests where all scopes are invalid.

Affected products

doorkeeper-gem Doorkeeper OpenID Connect prior to 1.10.4

Timeline

2026-08-05: disclosed
2026-07-02: patched: version 1.10.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.