Categories
CVE-2026-3531

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a logi...

Original description

The description as published by the source.

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.

A visitor who successfully logs in to their Identity Provider and is denied access to Drupal through custom code or a server error will maintain their session at the Identity Provider, possibly leading to access bypass situations, especially in a shared computing environment.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Packagist:https://packages.drupal.org/8 drupal/openid_connect
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}],"database_specific":{"constraint":"<1.5.0"}}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details