rubygem-doorkeeper -- token revocation vulnerability

2018-07-13T00:00:00
ID E309A2C7-598B-4FA6-A398-BC72FBD1D167
Type freebsd
Reporter FreeBSD
Modified 2018-08-03T00:00:00

Description

NVD reports:

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.