cve.bz

CVE-2019-9837

6.1 mediumEPSS 1.3%

Medium (6.1) in openid openid connect. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in doorkeeper-openid_connect 1.5.4.

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.

Severity

CVSS 3.0

6.1 medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE
CWE-601
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-vv4c-g6q7-p3q7RubyGemsdoorkeeper-openid_connect>=1.4.0 <1.5.41.5.4

References

Check your stackJSON