-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| doorkeeper | rubygems | < 5.6.6 | 5.6.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Doorkeeper automatically processing authorization requests for public clients that had been previously approved, violating RFC 8252's requirement to ensure client identity assurance. The fix in PR #1646 specifically targets the logic that skips user consent. The skip_authorization? method in the authorization controller is the logical point where this check occurs. Prior to the patch, this method did not properly restrict automatic approval to confidential clients, allowing public clients to bypass user consent. The high confidence comes from the direct correlation between the vulnerability description, the fix's purpose, and the typical structure of OAuth authorization flows in Doorkeeper.
A Semantic Attack on Google Gemini - Read the Latest Research