Refine your search
2 vulnerabilities found for Simple OAuth (OAuth2) & OpenID Connect by Drupal
CVE-2026-114542 (GCVE-0-2026-114542)
Vulnerability from cvelistv5
Published
2026-10-30 03:09
Modified
2026-10-30 03:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-525 - Use of Web Browser Cache Containing Sensitive Information
Summary
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Drupal | Simple OAuth (OAuth2) & OpenID Connect |
Version: 6.1.0 ≤ |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/simple_oauth",
"product": "Simple OAuth (OAuth2) \u0026 OpenID Connect",
"repo": "https://git.drupalcode.org/project/simple_oauth",
"vendor": "Drupal",
"versions": [
{
"lessThan": "6.1.3",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonathan Shaw (jonathanshaw)"
},
{
"lang": "en",
"type": "finder",
"value": "Alexander Varwijk (kingdutch)"
},
{
"lang": "en",
"type": "finder",
"value": "Mingsong (mingsong)"
},
{
"lang": "en",
"type": "finder",
"value": "Stephan Huber (stmh)"
},
{
"lang": "en",
"type": "finder",
"value": "Trevor Bradley (trevorbradley)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bojan Bogdanovic (bojan_dev)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Varwijk (kingdutch)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mingsong (mingsong)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Trevor Bradley (trevorbradley)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jonathan Shaw (jonathanshaw)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Benji Fisher (benjifisher)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Damien McKenna (damienmckenna)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Neil Drumm (drumm)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
}
],
"datePublic": "2026-10-21T17:54:41.000Z",
"descriptions": [
{
"lang": "en",
"value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) \u0026 OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) \u0026 OpenID Connect versions: from 6.1.0 to 6.1.3."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-525",
"description": "CWE-525 Use of Web Browser Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:09:26.573Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-242"
}
],
"title": "Simple OAuth (OAuth2) \u0026 OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-114542",
"datePublished": "2026-10-30T03:09:26.573Z",
"dateReserved": "2026-10-21T17:08:25.388Z",
"dateUpdated": "2026-10-30T03:09:26.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12466 (GCVE-0-2025-12466)
Vulnerability from cvelistv5
Published
2025-10-29 23:14
Modified
2025-10-30 14:38
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Drupal | Simple OAuth (OAuth2) & OpenID Connect |
Version: 6.0.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-12466",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-30T14:37:41.111051Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T14:38:59.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/simple_oauth",
"defaultStatus": "unaffected",
"product": "Simple OAuth (OAuth2) \u0026 OpenID Connect",
"repo": "https://git.drupalcode.org/project/simple_oauth",
"vendor": "Drupal",
"versions": [
{
"lessThan": "6.0.7",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "coffeemakr"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bojan Bogdanovic (bojan_dev)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "coffeemakr"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
}
],
"datePublic": "2025-10-29T16:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) \u0026amp; OpenID Connect allows Authentication Bypass.\u003cp\u003eThis issue affects Simple OAuth (OAuth2) \u0026amp; OpenID Connect: from 6.0.0 before 6.0.7.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) \u0026 OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) \u0026 OpenID Connect: from 6.0.0 before 6.0.7."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T23:14:51.343Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2025-114"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Simple OAuth (OAuth2) \u0026 OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2025-12466",
"datePublished": "2025-10-29T23:14:51.343Z",
"dateReserved": "2025-10-29T14:43:07.597Z",
"dateUpdated": "2025-10-30T14:38:59.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}