Project:
Date:
2026-March-04
Vulnerability:
Access bypass
Affected versions:
<1.5.0
CVE IDs:
CVE-2026-3531
Description:
This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.
A visitor who successfully logs in to their Identity Provider and is denied access to Drupal through custom code or a server error will maintain their session at the Identity Provider, possibly leading to access bypass situations, especially in a shared computing environment.
Solution:
Install the latest version:
- If you use the OpenID Connect 8.x-1.x module, upgrade to OpenID Connect 8.x-1.5
Reported By:
Coordinated By:
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
