CVE-2026-118554

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-118554 OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

EUVD-2026-113687

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-118554

The Drupal OpenID Connect Client module (versions 0.0.0 to 2.3.1 ) contains an authentication bypass vulnerability. The root cause is that the module attempts to link a new user logging in via OpenID Connect (oAuth2) to an existing account sharing the same email address. This allows an attacker t...

PT-2026-95856

TuxCare rebuilt drupal/openid connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare...

EUVD-2026-16389

Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

EUVD-2026-16385

Server-Side Request Forgery SSRF vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

CVE-2026-3532

Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

CVE-2026-3531

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

CVE-2026-3530: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

Drupal OpenID Connect/OAuth client security vulnerabilities

The Drupal OpenID Connect/OAuth client is an openID connection and OAuth client provided by the Drupal company. Versions of the Drupal OpenID Connect/OAuth client prior to version 1.5.0 contained security vulnerabilities. These vulnerabilities were due to improper handling of case sensitivity,...