{"id":"CVE-2026-0948","aliases":["DRUPAL-CONTRIB-2026-005","EUVD-2026-5338","GHSA-pv5x-hh3r-86w9"],"status":"published","title":"Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00229,"percentile":0.13776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2026-01-14T17:57:31Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/social_auth_entra_id","fixed_in":["1.0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/social_auth_entra_id","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]}],"products":[{"vendor":"drupal","product":"microsoft entra id sso login"},{"vendor":"jaseerkinangattil","product":"microsoft_entra_id_sso_login"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-005","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0948","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pv5x-hh3r-86w9"},{"url":"https://git.drupalcode.org/project/social_auth_entra_id","tags":["web"]},{"url":"https://www.drupal.org/project/social_auth_entra_id","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0948.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-0948","title":"Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.","status":"published","published":"2026-02-04T20:26:02.605Z","modified":"2026-02-04T21:23:18.337Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-5338","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.","status":"published","published":"2026-02-04T20:26:02Z","modified":"2026-02-04T21:23:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:43.720683Z"}],"ghsa":[{"id":"GHSA-pv5x-hh3r-86w9","title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra...","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.","status":"published","published":"2026-02-04T21:30:32Z","modified":"2026-02-05T00:32:02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:06:03.410025Z"}],"nvd":[{"id":"CVE-2026-0948","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.","status":"published","published":"2026-02-04T21:15:59.143Z","modified":"2026-06-17T10:11:40.403Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-0948","title":"Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.","status":"published","published":"2026-02-04T20:26:02.605Z","modified":"2026-10-28T02:31:02.080220757Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DRUPAL-CONTRIB-2026-005","description":"This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0.\n\nThe module doesn't sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account.","status":"published","published":"2026-01-14T17:57:31Z","modified":"2026-09-10T03:46:11.885847011Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}