Openid Connect Oauth Client CVE-2026-3531

Risk assessment is constrained by missing CVSS vector, CVSS score, and EPSS data. However, several factors indicate moderate to high real-world priority: (1) Authentication bypass vulnerabilities are typically high-impact, affecting confidentiality and integrity of user accounts; (2) The affected version range (0.0.0 to <1.5.0) suggests broad deployment exposure; (3) OpenID Connect / OAuth modules are critical trust anchors in modern Drupal authentication; (4) No public exploit code or confirmed active exploitation (KEV status) is indicated in available data, reducing immediate tactical urgency but not strategic risk. Organizations with Drupal instances using affected versions should prioritize patching regardless of exploit availability, as authentication bypass vulnerabilities are frequently targeted once disclosed. The absence of CVSS metrics prevents severity comparison with other vulnerabilities, but the vulnerability class alone warrants remediation planning.

A remote attacker discovers or exploits an alternate authentication path in a vulnerable Drupal OpenID Connect / OAuth client installation, such as a code path that fails to validate OAuth state parameters or improperly handles token validation. By crafting a request that leverages this alternate channel, the attacker bypasses standard OpenID Connect / OAuth verification and gains authenticated access to a Drupal user account without providing valid credentials or possessing the user's external identity provider credentials. No public proof-of-concept or confirmed active exploitation has been identified at the time of this analysis.