Doorkeeper is an OAuth 2.0 authorization library with a focused but prominent role in Ruby on Rails applications, where it handles critical authentication and delegation logic. Vulnerabilities affecting this vendor skew toward serious outcomes and recur through weakness classes centered on authentication bypass, authorization failures, and request-forgery protection—flaws inherent to the trust boundaries and state management that OAuth implementations must enforce. Defenders relying on Doorkeeper should treat its advisories as high-priority within their application stack; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Doorkeeper Project over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-1000211HIGH Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked fo | Jul 13, 2018 | 7.5 | 25 | NO | NO |
CVE-2016-6582CRITICAL The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Re | Jan 23, 2017 | 9.1 | 24 | NO | NO |
CVE-2018-1000088MEDIUM Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Store | Mar 13, 2018 | 6.1 | 21 | NO | NO |
CVE-2023-34246MEDIUM Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clien | Jun 12, 2023 | 6.5 | 20 | NO | NO |
CVE-2020-10187HIGH Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application ow | May 4, 2020 | 7.5 | 20 | NO | NO |
CVE-2014-8144MEDIUM Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user | Dec 31, 2014 | 6.8 | 18 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Doorkeeper Project.
Media articles that mention a CVE ID that affects a product developed by Doorkeeper Project — matched by CVE ID, not by vendor name.