{"id":"CVE-2026-3530","aliases":["CLSA-2026-1788968613","DRUPAL-CONTRIB-2026-025","EUVD-2026-16385","GHSA-2mq5-fr5w-rr29"],"status":"published","title":"OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00168,"percentile":0.06156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-03-04T18:00:41Z","modified":"2026-10-15T09:48:00Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/openid_connect","fixed_in":["1.5.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.3"},{"fixed":"7.1.3-p1+tuxcare"}]}],"versions":["7.1.3"],"bundled":3},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]}],"products":[{"vendor":"bojanz","product":"openid_connect_\\/_oauth_client"},{"vendor":"drupal","product":"openid connect / oauth client"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-025","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3530"},{"url":"https://github.com/advisories/GHSA-2mq5-fr5w-rr29"}],"sources":{"cve":[{"id":"CVE-2026-3530","title":"OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T20:03:39.756Z","modified":"2026-03-30T14:54:58.296Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-16385","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T20:03:39Z","modified":"2026-03-30T14:54:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:25.878486Z"}],"ghsa":[{"id":"GHSA-2mq5-fr5w-rr29","title":"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows...","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T21:31:28Z","modified":"2026-03-30T15:32:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:06:55.220248Z"}],"nvd":[{"id":"CVE-2026-3530","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T21:17:09.15Z","modified":"2026-06-17T10:43:43.72Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CLSA-2026-1788968613","title":"TuxCare security update for drupal/openid_connect (3 CVEs)","description":"TuxCare rebuilt drupal/openid_connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare.","status":"published","published":"2026-09-09T15:43:33Z","modified":"2026-10-15T09:48:00.39840955Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"DRUPAL-CONTRIB-2026-025","description":"This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.\n\nThe module doesn't sufficiently validate certain fields coming from the identity provider, which could lead to SSRF and information disclosures.\n\nThis vulnerability is mitigated by:  \n- an attacker must have access to the identity provider to provide compromised data at the source profile.  \n- a site must have specific field mappings configured","status":"published","published":"2026-03-04T18:00:41Z","modified":"2026-09-10T03:45:53.384028856Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}