CVE-2026-3531
This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a logi...
Original description
The description as published by the source.
This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.
A visitor who successfully logs in to their Identity Provider and is denied access to Drupal through custom code or a server error will maintain their session at the Identity Provider, possibly leading to access bypass situations, especially in a shared computing environment.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/openid_connect
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}],"database_specific":{"constraint":"<1.5.0"}}]
References
- web drupal.org