55728

**Name of the Vulnerable Software and Affected Versions** Doorkeeper OpenID Connect versions prior to 1.10.4 **Description** The Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the `DynamicClientRegistrationController#application params` function, the `scope` parameter is assigned directly from `params[:scope]` without validation against `Doorkeeper.configuration.scopes` or `optional scopes`. Because `enforce configured scopes` is disabled by default and the `ScopeChecker` prioritizes application-level scopes over server-level scopes, a self-registered client can obtain scopes beyond those intended by the server, leading to privilege escalation. **Recommendations** Update to version 1.10.4.

**Name of the Vulnerable Software and Affected Versions** Doorkeeper versions prior to 1.10.0 **Description** An issue exists in the Dynamic Client Registration feature where applications are created with the `confidential` variable hard-coded to `false`. Although the registration response provides a `client secret` and claims support for `client secret basic` and `client secret post` authentication methods, the secret is never verified because the system treats blank or missing secrets as valid for non-confidential clients. Consequently, an attacker possessing only the `client id` can authenticate at the token endpoint and obtain an access token without a secret. This affects only projects that have explicitly enabled Dynamic Client Registration, as it is disabled by default. The flaw is located in the `DynamicClientRegistrationController#register` action and the `Application.by uid and secret()` function. **Recommendations** Update to version 1.10.0. As a temporary workaround, update existing applications created via Dynamic Client Registration to set `confidential: true`.