{"id":"CVE-2025-31684","aliases":["DRUPAL-CONTRIB-2025-013","EUVD-2025-9041","GHSA-6chf-hhqf-749c"],"status":"published","title":"OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0018,"percentile":0.07692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-02-05T17:24:48Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Packagist","package":"drupal/oauth2_client","fixed_in":["4.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/oauth2_client","fixed_in":["4.1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/oauth2_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/oauth2_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/oauth2_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}]}],"products":[{"vendor":"drupal","product":"oauth2 client"},{"vendor":"mskcc","product":"oauth2_client"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-013","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31684","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6chf-hhqf-749c"},{"url":"https://git.drupalcode.org/project/oauth2_client","tags":["web","package"]},{"url":"https://www.drupal.org/project/oauth2_client","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31684.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31684","title":"OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","status":"published","published":"2025-03-31T21:43:06.076Z","modified":"2025-04-29T15:33:07.247Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-9041","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","status":"published","published":"2025-03-31T21:43:06Z","modified":"2025-04-29T15:33:07Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-6chf-hhqf-749c","title":"Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery. This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:20:35Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31684","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","status":"published","published":"2025-03-31T22:15:20.993Z","modified":"2026-06-17T09:10:46.183Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31684","title":"OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","status":"published","published":"2025-03-31T21:43:06.076Z","modified":"2026-10-28T02:30:45.967874965Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-6chf-hhqf-749c","title":"Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery. This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:09.508975Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"},{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"DRUPAL-CONTRIB-2025-013","description":"This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources.\n\nThe module does not use Cross Site Request Forgery (CSRF) tokens to protect routes for enabling a client.\n\nThis vulnerability is mitigated by the fact that an attacker must know the machine name of the client and deceive another user with this permission.","status":"published","published":"2025-02-05T17:24:48Z","modified":"2026-09-10T03:46:10.583124636Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}