Drupal Openid vulnerabilities

• drupal openid connect client OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 CVE-2026-118554 Fix available 5.4 MediumOctober 28, 2026
• drupal simple oauth (oauth2) & openid connect Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 CVE-2026-114542 Fix available 5.4 MediumOctober 21, 2026
• drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 more OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027 CVE-2026-3532 Fix available 4.2 MediumMarch 4, 2026
• drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 more OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 CVE-2026-3531 Fix available 6.5 MediumMarch 4, 2026
• drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 more OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025 CVE-2026-3530 Fix available 4.3 MediumMarch 4, 2026
• drupal simple oauth (oauth2) & openid connect, simple oauth project oauth +1 more Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114 CVE-2025-12466 Fix available 7.5 HighOctober 29, 2025
• drupal oauth & openid connect single sign on – sso (oauth/oidc client), miniorange oauth \& openid connect single sign-on +1 more OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067 CVE-2024-13301 Fix available 6.1 MediumDecember 4, 2024
• drupal openid The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned... CVE-2008-0570 5.0 MediumFebruary 5, 2008