PT-2026-3739 · Packagist · Drupal/Social Auth Entra Id
Published
2026-01-14
·
Updated
2026-01-14
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0.
The module doesn't sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Drupal/Social Auth Entra Id