CVE-2026-70665

Name of the Vulnerable Software and Affected Versions Doorkeeper OpenID Connect versions prior to 1.10.4

Description The Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the DynamicClientRegistrationController#application params function, the scope parameter is assigned directly from params[:scope] without validation against Doorkeeper.configuration.scopes or optional scopes. Because enforce configured scopes is disabled by default and the ScopeChecker prioritizes application-level scopes over server-level scopes, a self-registered client can obtain scopes beyond those intended by the server, leading to privilege escalation.

Recommendations Update to version 1.10.4.