Drupal Simple OAuth (OAuth2) & OpenID Connect versions from 6.0.0 up to but not including 6.0.7 contain an authentication bypass vulnerability. This flaw allows attackers to bypass authentication mechanisms using an alternate path or channel. The issue is fixed in version 6.0.7.