https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T07:56:04.921710+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-216542 EUVD-2026-216542 2026-10-06T07:56:04.926492+00:00 EUVD-2026-216542 https://cve.radiocsirt.org/vuln/fkie_cve-2023-34246 fkie_cve-2023-34246 2026-10-06T07:56:04.926567+00:00

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.

 https://cve.radiocsirt.org/vuln/ghsa-7w2c-w47h-789w GHSA-7w2c-w47h-789w — Doorkeeper Improper Authentication vulnerability 2026-10-06T07:56:04.926628+00:00

Affected: RubyGems: doorkeeper

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6

> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646

 https://cve.radiocsirt.org/vuln/gsd-2023-34246 gsd-2023-34246 2026-10-06T07:56:04.926660+00:00 gsd-2023-34246 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-34246 UBUNTU-CVE-2023-34246 2026-10-06T07:56:04.926673+00:00

Affected: Ubuntu:Pro:16.04:LTS: ruby-doorkeeper, Ubuntu:Pro:18.04:LTS: ruby-doorkeeper, Ubuntu:20.04:LTS: ruby-doorkeeper, Ubuntu:22.04:LTS: ruby-doorkeeper

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.