Project:
Project machine name:
oauth2_token_managerDate:
2026-October-28
Vulnerability:
Access bypass
Affected versions:
<1.2.0
CVE IDs:
CVE-2026-118573
Description:
This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback.
The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to an account they control.
This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).
Solution:
Install the latest version:
- If you use the OAuth2 Token Manager module, upgrade to OAuth2 Token Manager 8.x-1.2
After updating, run database updates. If you suspect your Box, Quip or Slack integration was connected to an unauthorized account, re-initialize the system token with Drush.
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
