{"id":"GHSA-m6vc-f87m-cc2h","summary":"Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret","details":"### Impact\n\nThe `DynamicClientRegistrationController#register` action hard-codes `confidential: false` when creating applications (dynamic_client_registration_controller.rb:18-25), yet the response includes a client_secret and advertises `token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"]`.\n\nBecause Doorkeeper's `Application.by_uid_and_secret` treats a blank/missing secret as valid for non-confidential (public) clients, an\nattacker who knows only the client_id (which is public information) can authenticate as the dynamically-registered client at the token endpoint.\n\n**Note** that Dynamic Client Registration is opt-in feature which is disabled by default so only projects that explicitly enabled it are affected.\n\n**Steps to Reproduce**\n\n1. Enable dynamic client registration in the initializer\n2. POST /oauth/registration with client_name, redirect_uris, and scope\n3. Observe: response returns client_secret, but the created\nDoorkeeper::Application has confidential: false\n4. Call `Doorkeeper::Application.by_uid_and_secret(client_id, nil)` — it\nreturns the application (credentials bypass)\n5. POST /oauth/token with grant_type=client_credentials and only\nclient_id (no client_secret) — the token endpoint issues an access token\nwithout any secret verification\n\n\n### Patches\nPatched in 1.10.0\n\n### Workarounds\nUpgrade existing applications created with a Dynamic Client registration to have `confidential: true`","aliases":["CVE-2026-44476"],"modified":"2026-06-09T12:00:16.158054391Z","published":"2026-06-04T14:37:11Z","database_specific":{"github_reviewed_at":"2026-06-04T14:37:11Z","nvd_published_at":null,"cwe_ids":["CWE-290"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-m6vc-f87m-cc2h"},{"type":"PACKAGE","url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect"},{"type":"WEB","url":"https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases/tag/v1.10.0"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper-openid_connect/CVE-2026-44476.yml"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-44476"}],"affected":[{"package":{"name":"doorkeeper-openid_connect","ecosystem":"RubyGems","purl":"pkg:gem/doorkeeper-openid_connect"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.10.0"}]}],"versions":["1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-m6vc-f87m-cc2h/GHSA-m6vc-f87m-cc2h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}