CVE-2026-44476

Name of the Vulnerable Software and Affected Versions Doorkeeper versions prior to 1.10.0

Description An issue exists in the Dynamic Client Registration feature where applications are created with the confidential variable hard-coded to false. Although the registration response provides a client secret and claims support for client secret basic and client secret post authentication methods, the secret is never verified because the system treats blank or missing secrets as valid for non-confidential clients. Consequently, an attacker possessing only the client id can authenticate at the token endpoint and obtain an access token without a secret. This affects only projects that have explicitly enabled Dynamic Client Registration, as it is disabled by default. The flaw is located in the DynamicClientRegistrationController#register action and the Application.by uid and secret() function.

Recommendations Update to version 1.10.0. As a temporary workaround, update existing applications created via Dynamic Client Registration to set confidential: true.