The OAuth2 Token Manager module for Drupal allows management of system-wide OAuth2 access and refresh tokens for integrations such as Box, Quip, and Slack. A vulnerability exists because the module does not restrict access to its OAuth2 routes, potentially allowing an anonymous visitor to connect the site's integration to an account they control. However, exploitation requires the attacker to obtain the OAuth2 state value from a prior token initialization, which mitigates the risk. The issue is fixed in version 1.2.0.