PT-2026-23113 · Drupal+2 · Openid Connect / Oauth Client+1

Damien Mckenna + 4 · Publicado 2026-03-04 · Atualizado 2026-03-26 · CVE-2026-3530

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal OpenID Connect / OAuth client versions prior to 1.5.0

Description A Server-Side Request Forgery (SSRF) issue exists in the OpenID Connect / OAuth client module of Drupal. This flaw stems from insufficient validation of data received from the identity provider. Successful exploitation could lead to Server Side Request Forgery and information disclosure. An attacker must have access to the identity provider and the site must have specific field mappings configured for exploitation.

Recommendations Update to version 1.5.0 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-3530

DRUPAL-CONTRIB-2026-025

Produtos afetados

Openid Connect / Oauth Client

Drupal/Openid Connect

Referências · 4

• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-025 · Aviso do Fabricante
• https://drupal.org/sa-contrib-2026-025 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3530 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037280554065027247 · Publicação no Twitter