CVE-2026-44476
1 advisory.
RubyGems/doorkeeper-openid_connect CVE-2026-44476: medium, EPSS 0.56%
Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret
Action: Upgrade doorkeeper-openid_connect to 1.10.0 or later.
bundle update doorkeeper-openid_connectAffected
| introduced | fixed | last affected |
|---|---|---|
| 1.9.0 | 1.10.0 | - |
Fixed versions
| 1.10.0 |
Sources
- osv: GHSA-m6vc-f87m-cc2h
- https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-m6vc-f87m-cc2h
- https://github.com/doorkeeper-gem/doorkeeper-openid_connect
- https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases/tag/v1.10.0
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper-openid_connect/CVE-2026-44476.yml
- https://www.cve.org/CVERecord?id=CVE-2026-44476
CVE-2026-44476 · published · modified · JSON