{"id":"CVE-2026-118554","aliases":["DRUPAL-CONTRIB-2026-287","EUVD-2026-113687","GHSA-rvvv-5cm6-2jq5"],"status":"published","title":"OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00218,"percentile":0.12343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2026-10-28T17:37:54Z","modified":"2026-11-06T12:25:58Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/oidc","fixed_in":["2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/oidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}]}],"products":[{"vendor":"drupal","product":"openid connect client"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-287","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118554","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rvvv-5cm6-2jq5"},{"url":"https://git.drupalcode.org/project/oidc","tags":["web"]},{"url":"https://www.drupal.org/project/oidc","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118554.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118554","title":"OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","status":"published","published":"2026-10-30T03:08:38.343Z","modified":"2026-11-06T12:25:58.099Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-113687","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","status":"published","published":"2026-10-30T03:08:38Z","modified":"2026-11-06T12:25:58Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-rvvv-5cm6-2jq5","title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect...","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","status":"published","published":"2026-10-30T06:31:58Z","modified":"2026-11-06T15:31:19Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-118554","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","status":"published","published":"2026-10-30T04:18:20.84Z","modified":"2026-11-06T13:17:27.72Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118554","title":"OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","status":"published","published":"2026-10-30T03:08:38.343Z","modified":"2026-11-08T02:30:40.499144522Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-287","description":"The module enables authentication via the OpenID Connect (oAuth2) protocol.\n\nWhen a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.\n\nThis vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.","status":"published","published":"2026-10-28T17:37:54Z","modified":"2026-10-28T18:15:03.982040586Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}