CVE-2026-44476
MediumSummary
The vulnerability in the `register` action of the `DynamicClientRegistrationController` hard-codes `confidential: false` when creating applications, yet the response includes a `client_secret` and advertises `token_endpoint_auth_methods_supported: ["client_secret_basic"]`. This creates an inconsistency between the declared application type and the actual credentials provided.
Risk Assessment
The risk is that an application registered as non-confidential (public) receives a client secret, which may lead to misconfiguration and potential leakage of credentials if administrators or developers are unaware of this inconsistency.
Recommendation
It is recommended to immediately update the software to a version where this inconsistency is fixed, or manually configure dynamic client registration so that the confidentiality type matches the actual credentials provided.
Original NVD description (English source)
### Impact The `DynamicClientRegistrationController#register` action hard-codes `confidential: false` when creating applications (dynamic_client_registration_controller.rb:18-25), yet the response includes a client_secret and advertises `token_endpoint_auth_methods_supported: ["client_secret_basic"