DRUPAL-CONTRIB-2026-287

    Dashboard / Vulnerabilities / DRUPAL-CONTRIB-2026-287

    DRUPAL-CONTRIB-2026-287

    Published: 28 Oct 2026Last Modified: 28 Oct 2026

    Summary:

    Details: The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user. This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.

    References: https://www.drupal.org/sa-contrib-2026-287

    Affected packages

    Package

    Name: drupal/oidc

    Purl: pkg:composer/drupal/oidc?repository_url=https:%2F%2Fpackages.drupal.org%2F8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.3.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DRUPAL-CONTRIB-2026-287 | CVE-DB