The vulnerability lies in the OpenID Connect extension where the Dynamic Client Registration endpoint stores any scopes submitted by a client without checking them against the server’s allowed scopes. This allows a client to claim abilities it should not have, effectively granting it higher privileges than intended. The flaw originates from the code path that assigns the scopes directly from the request parameters without validation, combined with default configuration values that enable application‑level scopes to override server‑level restrictions.

Environments running Doorkeeper OpenID Connect for Ruby on Rails prior to version 1.10.4 are affected. The specific product is the doorkeeper‑gem’s doorkeeper‑openid_connect library. Users should verify their installed version and update when possible to 1.10.4 or later to eliminate the flaw.

The CVSS score of 4.2 indicates moderate risk, and no EPSS score is available, implying limited public exploitation data at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to first register a client with the server’s DCR endpoint, which is typically open to unauthenticated clients. If the attacker can submit arbitrary scopes, they can create or modify a client registration to obtain scopes beyond the admin’s intended scope set, leading to unauthorized data access or actions. Consequently, while the exploit is not trivial, it requires only the ability to use the registration endpoint.