CVE-2025-12466

The Simple OAuth (OAuth2) & OpenID Connect module for Drupal (versions 6.0.0 through 6.0.6 ) contains an Authentication Bypass vulnerability. The root cause is that the module does not sufficiently respect granted scopes, specifically affecting access checks based on roles. For example, routes re...