{"id":"CVE-2026-3531","aliases":["CLSA-2026-1788968613","DRUPAL-CONTRIB-2026-026","EUVD-2026-16387","GHSA-f2x9-px9q-jxw2"],"status":"published","title":"OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00255,"percentile":0.17227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2026-03-04T18:02:14Z","modified":"2026-10-15T09:48:00Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/openid_connect","fixed_in":["1.5.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.3"},{"fixed":"7.1.3-p1+tuxcare"}]}],"versions":["7.1.3"],"bundled":3},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]}],"products":[{"vendor":"bojanz","product":"openid_connect_\\/_oauth_client"},{"vendor":"drupal","product":"openid connect / oauth client"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-026","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3531"},{"url":"https://github.com/advisories/GHSA-f2x9-px9q-jxw2"}],"sources":{"cve":[{"id":"CVE-2026-3531","title":"OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T20:03:48.873Z","modified":"2026-03-30T14:54:51.55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-16387","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T20:03:48Z","modified":"2026-03-30T14:54:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:25.878486Z"}],"ghsa":[{"id":"GHSA-f2x9-px9q-jxw2","title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect /...","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T21:31:28Z","modified":"2026-03-30T15:32:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:06:55.220248Z"}],"nvd":[{"id":"CVE-2026-3531","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T21:17:09.283Z","modified":"2026-06-17T10:43:43.857Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CLSA-2026-1788968613","title":"TuxCare security update for drupal/openid_connect (3 CVEs)","description":"TuxCare rebuilt drupal/openid_connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare.","status":"published","published":"2026-09-09T15:43:33Z","modified":"2026-10-15T09:48:00.39840955Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"DRUPAL-CONTRIB-2026-026","description":"This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.\n\nA visitor who successfully logs in to their Identity Provider and is denied access to Drupal through custom code or a server error will maintain their session at the Identity Provider, possibly leading to access bypass situations, especially in a shared computing environment.","status":"published","published":"2026-03-04T18:02:14Z","modified":"2026-09-10T03:46:03.72294918Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}