Skip to content
OpenAdvisories
Medium USN-6210-1 1 CVE

ruby-doorkeeper vulnerability

Published Jul 7, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Doorkeeper incorrectly performed authorization checks
for public clients that have been previous approved. An attacker could
potentially exploit these in order to impersonate another user and obtain
sensitive information.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ruby-doorkeeper 5.0.2-2ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS ruby-doorkeeper 5.5.0-2ubuntu0.22.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-doorkeeper 2.2.1-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-doorkeeper 4.3.1-1ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 4.2
    CVE-2023-34246

    Doorkeeper Improper Authentication vulnerability

    Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable t…

    doorkeeper-gem doorkeeper doorkeeper ruby-doorkeeper Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2023-34246