# CVE-2026-70665: Doorkeeper OpenID Connect scope validation bypass in Dynamic Client Registration

Source: https://junglewise.ai/threats/cve-2026-70665-doorkeeper-openid-connect-scope-validation-bypass-in-dynamic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70665 · Severity: medium · CVSS 4.2 · Published 2026-08-25

Doorkeeper OpenID Connect is a Ruby gem that adds OpenID Connect authentication to Rails applications. The Dynamic Client Registration endpoint allows applications to self-register and request OAuth scopes, but prior to version 1.10.4 it failed to validate requested scopes against the server's configured list. An attacker could register a malicious client claiming administrative or other privileged scopes, then obtain tokens with those unintended permissions, effectively elevating their access beyond what the server intended to grant.

## Quick answers

**Is CVE-2026-70665 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70665 being exploited in the wild.

**How severe is CVE-2026-70665?** Medium severity, with a CVSS score of 4.2, published 25 August 2026.

**Which products and versions are affected?** doorkeeper-gem Doorkeeper OpenID Connect prior to 1.10.4.

**Is there a fix for CVE-2026-70665?** A patch was published on 2026-07-02: version 1.10.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70665 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-70665?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authorization / scope validation flaw in the Dynamic Client Registration (DCR) endpoint. In DynamicClientRegistrationController#application_params, user-supplied scope parameters are persisted directly without validation against Doorkeeper.configuration.scopes or optional_scopes. The issue is compounded because enforce_configured_scopes is off by default, and Doorkeeper's ScopeChecker prioritizes application-level scopes over server-level scopes during token issuance. This allows an unauthenticated attacker to self-register a client with arbitrary scopes (e.g., "admin") and later obtain tokens claiming those privileges. The fix in v1.10.4 validates DCR-supplied scopes against the server's configured scope set, silently dropping unrecognized ones and rejecting requests where all scopes are invalid.

## Affected products

- doorkeeper-gem Doorkeeper OpenID Connect prior to 1.10.4

## Timeline

- 2026-08-05: disclosed
- 2026-07-02: patched: version 1.10.4 released

## References

- [https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/24c3cb1729b69f48649a6f4491dcae69f805000d](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/24c3cb1729b69f48649a6f4491dcae69f805000d)
- [https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-8r7r-wh7x-27ff](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-8r7r-wh7x-27ff)