CVE-2026-114542 (GCVE-0-2026-114542)
Vulnerability from cvelistv5
Published
2026-10-30 03:09
Modified
2026-10-30 03:09
Severity ?
CWE
  • CWE-525 - Use of Web Browser Cache Containing Sensitive Information
Summary
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.
References
Impacted products
Vendor Product Version
Drupal Simple OAuth (OAuth2) & OpenID Connect Version: 6.1.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/simple_oauth",
          "product": "Simple OAuth (OAuth2) \u0026 OpenID Connect",
          "repo": "https://git.drupalcode.org/project/simple_oauth",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "6.1.3",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonathan Shaw (jonathanshaw)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander Varwijk (kingdutch)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsong  (mingsong)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Stephan Huber (stmh)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Trevor Bradley (trevorbradley)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bojan Bogdanovic (bojan_dev)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexander Varwijk (kingdutch)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mingsong  (mingsong)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Trevor Bradley (trevorbradley)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Shaw (jonathanshaw)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-10-21T17:54:41.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) \u0026 OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) \u0026 OpenID Connect versions: from 6.1.0 to 6.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-525",
              "description": "CWE-525 Use of Web Browser Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:26.573Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-242"
        }
      ],
      "title": "Simple OAuth (OAuth2) \u0026 OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-114542",
    "datePublished": "2026-10-30T03:09:26.573Z",
    "dateReserved": "2026-10-21T17:08:25.388Z",
    "dateUpdated": "2026-10-30T03:09:26.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.