CVE-2016-6582 json
Doorkeeper is vulnerable to replay attacks
published 2017-01-23 9 y ago modified 2026-06-17 4 mo ago also GHSA-3m6r-39p3-jq25 , EUVD-2017-0157
- cvss
- 9.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.8%
- EPSS 4.8% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Patch / fix
- rubygems doorkeeper 4.2.0
- ruby-doorkeeper Debian 14, Debian 13, Debian 12 4.2.0-3
debian advisories DEBIAN-CVE-2016-6582
- ruby-doorkeeper Ubuntu Pro 16.04 LTS 2.2.1-1ubuntu0.1~esm2
ubuntu advisories UBUNTU-CVE-2016-6582
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Exploit prediction
4.81% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P |
| GitHub | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | doorkeeper | <4.2.0 |
4.2.0 |
Classification
References
-
seclists.org
/fulldisclosure/2016/Aug/105
mailing-list, web, patch, third-party-advisory
-
github.com
/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0
web, issue-tracking, patch, release-notes, third-party-advisory
-
github.com
/doorkeeper-gem/doorkeeper/issues/875
web, issue-tracking, patch, third-party-advisory
-
securityfocus.com
/bid/92551
vdb-entry, third-party-advisory
-
packetstormsecurity.com
/files/138430/Doorkeeper-4.1.0-Token-Revocation.html
web, third-party-advisory, vdb-entry
-
securityfocus.com
/archive/1/539268/100/0/threaded
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2016-6582
advisory
-
github.com
/advisories/GHSA-3m6r-39p3-jq25
advisory
-
github.com
/doorkeeper-gem/doorkeeper
web
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml
web
-
web.archive.org
/web/20170214021758/http://www.securityfocus.com/bid/92551
web
-
web.archive.org
/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded
web
-
openwall.com
/lists/oss-security/2016/08/19/2
web
Sources
- CVE List CVE-2016-6582
- GitHub Advisory GHSA-3m6r-39p3-jq25
- NVD CVE-2016-6582
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.