Threats tagged 'drupal-contrib-2026-284'

The OAuth login OAuth2 module for Drupal allows login via OAuth 2.0 or OpenID Connect identity providers. A vulnerability exists due to insufficient access checks on a configuration route and lack of verification that the identity provider has confirmed the email address it returns. This flaw enables an attacker to log in as any existing user if they know that user's email address. Exploitation requires the attacker to have an account with a configured identity provider and control over at least one returned attribute, such as username. The issue is fixed in version 3.1.1.