CVE-2026-0948

This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0. The module doesn't sufficiently va...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0.

The module doesn't sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Packagist:https://packages.drupal.org/8 drupal/social_auth_entra_id

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}],"database_specific":{"constraint":"<1.0.4"}}]

参照URL

web drupal.org