Medium severity4.2NVD Advisory· Published Jun 12, 2023· Updated Jun 17, 2026
CVE-2023-34246
CVE-2023-34246
Description
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
doorkeeperRubyGems | < 5.6.6 | 5.6.6 |
Affected products
3- doorkeeper-gem/doorkeeperv5Range: < 5.6.6
- cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*Range: <5.6.6
Patches
Vulnerability mechanics
References
10- github.com/doorkeeper-gem/doorkeeper/pull/1646nvdPatchWEB
- github.com/doorkeeper-gem/doorkeeper/issues/1589nvdExploitIssue TrackingWEB
- github.com/advisories/GHSA-7w2c-w47h-789wghsaADVISORY
- github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789wnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-34246ghsaADVISORY
- github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6nvdRelease NotesWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.ymlghsaWEB
- lists.debian.org/debian-lts-announce/2023/07/msg00016.htmlnvdWEB
- lists.debian.org/debian-lts-announce/2024/12/msg00010.htmlnvdWEB
- www.rfc-editor.org/rfc/rfc8252nvdTechnical DescriptionWEB
News mentions
0No linked articles in our index yet.