PT-2026-3747 · Drupal+2 · Entra Id Sso Login+1

Ashish Verma + 5 · Publicado 2026-01-14 · Atualizado 2026-02-04 · CVE-2026-0948

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Microsoft Entra ID SSO Login versions prior to 1.0.4

Description The Microsoft Entra ID SSO Login module for Drupal does not properly validate responses received from the Microsoft Entra ID service. This insufficient validation can lead to a complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account. The issue involves an authentication bypass using an alternate path or channel, potentially allowing privilege escalation.

Recommendations Update to version 1.0.4 or later.

Correção

LPE

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-0948

DRUPAL-CONTRIB-2026-005

Produtos afetados

Entra Id Sso Login

Drupal/Social Auth Entra Id

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-0948 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-0948 · Aviso do Fabricante
• https://drupal.org/sa-contrib-2026-005 · Aviso do Fabricante
• https://t.me/CVEtracker/43762 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2019182772376785212 · Publicação no Twitter
• https://t.me/cveNotify/150920 · Publicação no Telegram
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-005 · Aviso do Fabricante