CVE-2026-44476: Doorkeeper Openid Connect Dynamic Client Registration Feature Creates Vulnerability
MODERATECVE-2026-44476 is a MODERATE dynamic client registration feature creates vulnerability (CWE-290: Authentication Bypass by Spoofing) affecting Doorkeeper Openid Connect libraries in the RubyGems ecosystem. The issue involves dynamic client registration feature creates public clients with client_secret. Remediation is available by upgrading affected packages to version 1.10.0.
CVE-2026-44476 at a Glance
How to Fix CVE-2026-44476
To remediate this vulnerability, upgrade all affected Doorkeeper Openid Connect dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade doorkeeper-openid_connect to 1.10.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for doorkeeper-openid_connectHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-44476, inspect your project dependencies for Doorkeeper Openid Connect:
inspect dependencies for doorkeeper-openid_connectAnalyze the terminal output to locate any version of Doorkeeper Openid Connect in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.10.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-290: Authentication Bypass by Spoofing, where this attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. In Doorkeeper Openid Connect, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-44476 Affected Doorkeeper Openid Connect Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
doorkeeper-openid_connect
|
RubyGems |
≥ 1.9.0
< 1.10.0
All 1 versions
1.9.0
|
1.10.0
|
References
Frequently Asked Questions
What is CVE-2026-44476?
Which Doorkeeper Openid Connect versions are affected?
What version fixes CVE-2026-44476?
Is doorkeeper-openid_connect affected?
What CWE is associated with CVE-2026-44476?
How can I check RubyGems dependencies for CVE-2026-44476?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m6vc-f87m-cc2h",
"modified" : "2026-06-09T11:57:55Z",
"published" : "2026-06-04T14:37:11Z",
"aliases" : [ "CVE-2026-44476" ],
"summary" : "Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret",
"details" : "### Impact\n\nThe `DynamicClientRegistrationController#register` action hard-codes `confidential: false` when creating applications (dynamic_client_registration_controller.rb:18-25), yet the response includes a client_secret and advertises `token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"]`.\n\nBecause Doorkeeper's `Application.by_uid_and_secret` treats a blank/missing secret as valid for non-confidential (public) clients, an\nattacker who knows only the client_id (which is public information) can authenticate as the dynamically-registered client at the token endpoint.\n\n**Note** that Dynamic Client Registration is opt-in feature which is disabled by default so only projects that explicitly enabled it are affected.\n\n**Steps to Reproduce**\n\n1. Enable dynamic client registration in the initializer\n2. POST /oauth/registration with client_name, redirect_uris, and scope\n3. Observe: response returns client_secret, but the created\nDoorkeeper::Application has confidential: false\n4. Call `Doorkeeper::Application.by_uid_and_secret(client_id, nil)` — it\nreturns the application (credentials bypass)\n5. POST /oauth/token with grant_type=client_credentials and only\nclient_id (no client_secret) — the token endpoint issues an access token\nwithout any secret verification\n\n\n### Patches\nPatched in 1.10.0\n\n### Workarounds\nUpgrade existing applications created with a Dynamic Client registration to have `confidential: true`",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "RubyGems",
"name" : "doorkeeper-openid_connect"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.9.0"
}, {
"fixed" : "1.10.0"
} ]
} ],
"versions" : [ "1.9.0" ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-m6vc-f87m-cc2h"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/doorkeeper-gem/doorkeeper-openid_connect"
}, {
"type" : "WEB",
"url" : "https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases/tag/v1.10.0"
}, {
"type" : "WEB",
"url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper-openid_connect/CVE-2026-44476.yml"
}, {
"type" : "WEB",
"url" : "https://www.cve.org/CVERecord?id=CVE-2026-44476"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-290" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-04T14:37:11Z",
"nvd_published_at" : null
}
}