Moderate severityNVD Advisory· Published Jun 12, 2023· Updated Feb 13, 2025
Doorkeeper Improper Authentication vulnerability
CVE-2023-34246
Description
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
doorkeeperRubyGems | < 5.6.6 | 5.6.6 |
Affected products
2- doorkeeper-gem/doorkeeperv5Range: < 5.6.6
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-7w2c-w47h-789wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-34246ghsaADVISORY
- github.com/doorkeeper-gem/doorkeeper/issues/1589ghsax_refsource_MISCWEB
- github.com/doorkeeper-gem/doorkeeper/pull/1646ghsax_refsource_MISCWEB
- github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6ghsax_refsource_MISCWEB
- github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789wghsax_refsource_CONFIRMWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.ymlghsaWEB
- lists.debian.org/debian-lts-announce/2023/07/msg00016.htmlghsaWEB
- lists.debian.org/debian-lts-announce/2024/12/msg00010.htmlghsaWEB
- www.rfc-editor.org/rfc/rfc8252ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.