This vulnerability (CVE-2026-3531) in the Drupal OpenID Connect / OAuth client (versions before 1.5.0) involves an authentication bypass via an alternate path or channel (CWE-288). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. The issue allows an attacker to bypass authentication mechanisms, potentially gaining unauthorized access to protected resources. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation allows an attacker with low privileges to bypass authentication controls, potentially gaining unauthorized access to sensitive information. The confidentiality impact is high, but integrity and availability are not affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, restrict access to the affected OpenID Connect / OAuth client versions and monitor for unusual authentication behavior. Avoid deploying affected versions in production environments where possible.