Project: 
OpenID Connect Client
Project machine name: 
oidc
Date: 
2026-October-28
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Improper authentication
Affected versions: 
<2.3.1
CVE IDs: 
CVE-2026-118554
Description: 

The module enables authentication via the OpenID Connect (oAuth2) protocol.

When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.

This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.

Solution: 

Install the latest version:

Linking new users to an existing account is now disabled by default and can be re-enabled on the settings page. When using a generic realm it's also highly recommended to configure the email verified claim.

Reported By: 
Fixed By: 
Coordinated By: