Drupal Simple OAuth CVE-2025-12466

The target must run the Drupal 'Simple OAuth (OAuth2) & OpenID Connect' contrib module at a version from 6.0.0 up to (but not including) 6.0.7, with its OAuth2/OpenID Connect authentication endpoints exposed to the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration is indicated - exploitation uses an alternate authentication path or channel (CWE-288) against the module's auth flow. Limiting factors: only this specific module and version range are affected, so sites not using Simple OAuth, or already on 6.0.7+, are not exposed; the available vendor patch directly removes the condition.

Signals are moderately consistent and point to a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which fits an authentication-bypass (CWE-288) weakness and justifies the 7.5 'High' base score; however, impact is confidentiality-only (C:H/I:N/A:N), limiting the worst case to unauthorized read/access rather than full takeover. The EPSS score is low (0.36%, 28th percentile), indicating a low modeled probability of near-term widespread exploitation, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. No public proof-of-concept is referenced in the provided data, and no SSVC decision data was supplied. The combination - unauthenticated network access plus low complexity, but confidentiality-only impact, low EPSS, no KEV, and no known POC - suggests this should be patched promptly on exposed Drupal sites but does not currently warrant crisis-level response. One caveat: an authentication bypass often enables broader impact than confidentiality alone, so the vendor-assigned I:N/A:N may understate downstream consequences once an attacker gains an authenticated identity; verify scope against the Drupal advisory.

A remote, unauthenticated attacker crafts a request to a Drupal site running the Simple OAuth (OAuth2) & OpenID Connect module (versions 6.0.0 up to 6.0.7) and uses an alternate authentication path or channel to bypass the intended OAuth/OpenID Connect validation, obtaining access to protected resources or a user context they should not hold. Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required. No public exploit code is identified at time of analysis.