PT-2026-23114 · Drupal+2 · Openid Connect / Oauth Client+1

Damien Mckenna + 4 · Publicado 2026-03-04 · Atualizado 2026-03-26 · CVE-2026-3531

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal OpenID Connect / OAuth client versions prior to 1.5.0

Description A flaw exists in the OpenID Connect / OAuth client module that could allow for authentication bypass. Specifically, if a user successfully authenticates with their Identity Provider but is denied access to Drupal due to custom code or a server error, their session remains active at the Identity Provider. This can potentially lead to unauthorized access, particularly in shared computing environments, where a user who initially failed to authenticate may gain access through an alternate path.

Recommendations Update to version 1.5.0 or later.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-3531

DRUPAL-CONTRIB-2026-026

Produtos afetados

Openid Connect / Oauth Client

Drupal/Openid Connect

Referências · 4

• https://twitter.com/CVEnew/status/2037280552987091181 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3531 · Nota de Segurança
• https://drupal.org/sa-contrib-2026-026 · Aviso do Fabricante
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-026 · Aviso do Fabricante