{"id":"CVE-2026-3532","aliases":["CLSA-2026-1788968613","DRUPAL-CONTRIB-2026-027","EUVD-2026-16389","GHSA-g8fg-x943-8cvw"],"status":"published","title":"OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027","description":"Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00138,"percentile":0.03227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178"],"published":"2026-03-04T18:02:59Z","modified":"2026-10-15T09:48:00Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/openid_connect","fixed_in":["1.5.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.3"},{"fixed":"7.1.3-p1+tuxcare"}]}],"versions":["7.1.3"],"bundled":3},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/openid_connect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]}],"products":[{"vendor":"bojanz","product":"openid_connect_\\/_oauth_client"},{"vendor":"drupal","product":"openid connect / oauth client"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-027","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3532"},{"url":"https://github.com/advisories/GHSA-g8fg-x943-8cvw"}],"sources":{"cve":[{"id":"CVE-2026-3532","title":"OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027","description":"Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T20:04:03.16Z","modified":"2026-03-27T13:53:59.637Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-16389","description":"Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T20:04:03Z","modified":"2026-03-27T13:53:59Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-g8fg-x943-8cvw","title":"Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client...","description":"Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T21:31:28Z","modified":"2026-03-27T15:31:27Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:06:54.074781Z"}],"nvd":[{"id":"CVE-2026-3532","description":"Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.","status":"published","published":"2026-03-26T21:17:09.42Z","modified":"2026-06-17T10:43:43.993Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CLSA-2026-1788968613","title":"TuxCare security update for drupal/openid_connect (3 CVEs)","description":"TuxCare rebuilt drupal/openid_connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare.","status":"published","published":"2026-09-09T15:43:33Z","modified":"2026-10-15T09:48:00.39840955Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"DRUPAL-CONTRIB-2026-027","description":"This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.\n\nThe module doesn't sufficiently validate the uniqueness of certain user fields depending on the database engine and its collation.\n\nAs a result, a user may be able to register with the same email address as another user.\n\nThis may lead to data integrity issues.","status":"published","published":"2026-03-04T18:02:59Z","modified":"2026-09-10T03:45:50.066556247Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}