CVE-2023-34246
Doorkeeper Improper Authentication vulnerability
- State
- Published
- Severity
- 4.2 Medium
- Published
- Jun 12, 2023
- Updated
- Feb 13, 2025
- Reserved
- May 31, 2023
Description
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
doorkeeperdoorkeeper-gem |
|
References
- https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w
- https://github.com/doorkeeper-gem/doorkeeper/issues/1589
- https://github.com/doorkeeper-gem/doorkeeper/pull/1646
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6
- https://www.rfc-editor.org/rfc/rfc8252#section-8.6
- https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00010.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.