A flaw in the Dynamic Client Registration routine of Doorkeeper OpenID Connect creates applications marked as public while still returning a client_secret. Because the system treats a missing or empty secret as valid for non‑confidential clients, an attacker who knows the public client_id can authenticate at the token endpoint without providing the secret, obtaining an access token. This bypasses the intended client authentication mechanism and can expose downstream resources. The weakness is captured by CWE‑1390 (Improper Privilege Management) and CWE‑287 (Improper Authentication).

Doorkeeper‑gem’s doorkeeper‑openid_connect product versions before 1.10.0 are affected, but only if the Dynamic Client Registration feature is enabled, which is disabled by default. Version 1.10.0 and later contain the fix.

The CVSS score of 6.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a client_id to the public token endpoint; no special privileges or additional access are required. The likelihood of exploitation is moderate, contingent on DCR being enabled and the attacker having the client_id.