doorkeeper-openid_connect
OpenID Connect extension for Doorkeeper
Activity
- Latest release
- 3w ago
- Total releases
- 45
- Cadence
- ~2 months
- Last 12 months
- 8
Reach
- Stars
- 217
Details
- License
- MIT
- First release
- Mar 24, 2015
| Version | Released | |
|---|---|---|
2.0.0.beta1
pre
|
2.0.0.beta1
pre
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.10.5
patch
|
1.10.5
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.10.4
patch
|
1.10.4
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.10.3
patch
|
1.10.3
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.10.2
patch
|
1.10.2
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.10.1
patch
|
1.10.1
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.10.0
minor
|
1.10.0
minor
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.9.0
minor
1 CVE
CVE-2026-44476
GHSA-m6vc-f87m-cc2h
Jun 04, 2026
Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret
Medium
Network
Low
None
None
ImpactThe Because Doorkeeper's Note that Dynamic Client Registration is opt-in feature which is disabled by default so only projects that explicitly enabled it are affected. Steps to Reproduce
PatchesPatched in 1.10.0 WorkaroundsUpgrade existing applications created with a Dynamic Client registration to have Affected versions
1.9.0
Fixed in
1.10.0
References
Updated Jun 09, 2026 · Source: OSV.dev |
1.9.0
minor
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.8.11
patch
|
1.8.11
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
1.8.10
patch
|
1.8.10
patch
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
1.8.9
patch
|
1.8.9
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.8
patch
|
1.8.8
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.7
patch
|
1.8.7
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.6
patch
|
1.8.6
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.5
patch
|
1.8.5
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.4
patch
|
1.8.4
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.3
patch
|
1.8.3
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.2
patch
|
1.8.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.1
patch
|
1.8.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.8.0
minor
|
1.8.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.8.0.pre.rc1
pre
|
1.8.0.pre.rc1
pre
Dependencies (7)
Changelog
Compare changes
|
|
1.7.5
patch
|
1.7.5
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.7.3
patch
|
1.7.3
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.7.4
patch
|
1.7.4
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.7.2
patch
|
1.7.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.7.1
patch
|
1.7.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.7.0
minor
|
1.7.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.6.3
patch
|
1.6.3
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.6.2
patch
|
1.6.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.6.1
patch
|
1.6.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.6.0
minor
|
1.6.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.5.5
patch
|
1.5.5
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.5.4
patch
|
1.5.4
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.5.3
patch
1 CVE
CVE-2019-9837
GHSA-vv4c-g6q7-p3q7
Mar 25, 2019
Doorkeeper-openid_connect contains Open Redirect
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow. Affected versions
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
Fixed in
1.5.4
References
Updated Nov 08, 2023 · Source: OSV.dev |
1.5.3
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.5.1
patch
1 CVE
CVE-2019-9837
GHSA-vv4c-g6q7-p3q7
Mar 25, 2019
Doorkeeper-openid_connect contains Open Redirect
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow. Affected versions
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
Fixed in
1.5.4
References
Updated Nov 08, 2023 · Source: OSV.dev |
1.5.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.5.2
patch
1 CVE
CVE-2019-9837
GHSA-vv4c-g6q7-p3q7
Mar 25, 2019
Doorkeeper-openid_connect contains Open Redirect
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow. Affected versions
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
Fixed in
1.5.4
References
Updated Nov 08, 2023 · Source: OSV.dev |
1.5.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.5.0
minor
1 CVE
CVE-2019-9837
GHSA-vv4c-g6q7-p3q7
Mar 25, 2019
Doorkeeper-openid_connect contains Open Redirect
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow. Affected versions
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
Fixed in
1.5.4
References
Updated Nov 08, 2023 · Source: OSV.dev |
1.5.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.4.0
minor
1 CVE
CVE-2019-9837
GHSA-vv4c-g6q7-p3q7
Mar 25, 2019
Doorkeeper-openid_connect contains Open Redirect
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow. Affected versions
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
Fixed in
1.5.4
References
Updated Nov 08, 2023 · Source: OSV.dev |
1.4.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.3.0
minor
|
1.3.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.2.0
minor
|
1.2.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.1.2
patch
|
1.1.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.1.1
patch
|
1.1.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
1.1.0
minor
|
1.1.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.0.1
patch
| ||
1.0.0
initial
|