DRUPAL-CONTRIB-2026-287

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/oidc/DRUPAL-CONTRIB-2026-287.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-287
Aliases
  • CVE-2026-118554
Published
2026-10-28T17:37:54Z
Modified
2026-10-28T18:15:03Z
Summary
[none]
Details

The module enables authentication via the OpenID Connect (oAuth2) protocol.

When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.

This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/oidc

Package

Name
drupal/oidc
Purl
pkg:composer/drupal/oidc?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.3.1
Database specific
Show details 
{
    "constraint":  "<2.3.1"
}

Database specific

affected_versions 
"<2.3.1"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/oidc/DRUPAL-CONTRIB-2026-287.json"