Openid Connect Oauth Client EUVD-2026-16385

The risk assessment is constrained by missing CVSS vector and EPSS data, preventing quantitative analysis of attack complexity, privilege requirements, and exploitation likelihood. However, SSRF vulnerabilities in authentication modules present significant real-world risk because they often bypass network segmentation and can lead to unauthorized access to internal services, cloud metadata endpoints, or sensitive configuration. The affected product (OpenID Connect / OAuth client) is a widely-deployed Drupal contributed module used in many enterprise and public sector Drupal installations, expanding the attack surface. The absence of a public exploit and CISA KEV status indicates no confirmed active exploitation; however, SSRF vulnerabilities are generally straightforward to exploit once identified, and attackers scanning for Drupal modules would likely test for this vector. The primary mitigating factor is that the vulnerability requires the module to be installed and configured, rather than affecting Drupal Core itself. Given the broad affected version range (0.0.0 to before 1.5.0), organizations should prioritize patching this module in environments handling sensitive authentication or connected to internal networks.

An attacker identifies a Drupal instance running the vulnerable OpenID Connect / OAuth client module and crafts a malicious authentication request that causes the module to fetch metadata or validate tokens from an attacker-controlled URL or internal network resource (e.g., http://169.254.169.254 for AWS metadata, or http://localhost:8080/admin for internal services). By manipulating OpenID Connect endpoints or redirect parameters, the attacker extracts sensitive information returned by the server's SSRF request, such as API credentials, cloud provider tokens, or internal service banners. This reconnaissance can facilitate further attacks against backend systems or lead to privilege escalation if internal APIs are accessible without additional authentication. No public proof-of-concept has been identified, but exploitation would likely require only standard HTTP client capabilities and knowledge of the module's parameter handling.