CyberRota Analysis
AI-GeneratedIn version 1.9.0 of Doorkeeper, an OAuth 2 provider for Ruby on Rails, a vulnerability allows attackers to authenticate as a dynamically registered client using only the public client_id, bypassing the need for a client_secret. This occurs due to the Dynamic Client Registration feature incorrectly treating non-confidential clients as valid without verifying the client_secret. Projects that have enabled Dynamic Client Registration should prioritize upgrading to version 1.10.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.