Improper Authentication

2023-06-2009:14:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

doorkeeper

vulnerability

improper authentication

oauth

rfc 8252

user authentication

0.001 Low

EPSS

Percentile

31.7%

JSON

doorkeeper is vulnerable to Improper Authentication. The vulnerability exists because user authentication is automatically processed without consent of the user if the authentication token matches, which is out of OAuth RFC 8252 spec, allowing an attacker to impersonate a user and possibly bypass authentication.

CPENameOperatorVersion
doorkeeperle5.6.5
doorkeeperle4.4.3
doorkeeperle5.6.5
doorkeeperle4.4.3
ruby-doorkeeper:sideq5.3.0-2
ruby-doorkeeper:sideq5.5.0-2
ruby-doorkeeper:sideq5.3.0-1

Name	Operator	Version
doorkeeper	le	5.6.5
doorkeeper	le	4.4.3
doorkeeper	le	5.6.5
doorkeeper	le	4.4.3
ruby-doorkeeper:sid	eq	5.3.0-2
ruby-doorkeeper:sid	eq	5.5.0-2
ruby-doorkeeper:sid	eq	5.3.0-1