Openid Connect Oauth Client EUVD-2026-16389

While CVSS scoring data is unavailable, the severity indicators point to high real-world risk. The vulnerability enables privilege escalation-a technical impact classified as high under CVSS. The attack vector is network-based (authentication flows are remote), and no special privileges are explicitly required to initiate the attack (typical for OAuth flows), suggesting low attack complexity. The privilege escalation impact means an attacker moving from low to high privilege is a realistic outcome. However, exploitation likely requires either (1) control over the OAuth/OIDC provider's claim issuance logic, or (2) the ability to register a lookalike account with case variations, both of which introduce practical barriers. Without EPSS data or CISA KEV confirmation, the likelihood of automated, mass exploitation is unclear. The availability of a patched version (1.5.0) lowers urgency only slightly, as unpatched deployments remain at risk. Organizations using federated authentication via this module should prioritize patching; exploitation may not require sophisticated tools but does require understanding of the identity provider's claim structure.

An attacker with access to an OAuth/OIDC provider (or control over a malicious provider registered with the Drupal site) crafts an authentication response containing a user claim with mixed case-for example, 'email': 'Admin@example.com' instead of the canonical 'admin@example.com'. If the Drupal module compares this claim case-sensitively and matches it to a high-privilege account that was previously registered with the lowercase variant, the attacker gains authenticated access as that admin user. Alternatively, an attacker registers a lookalike account at the identity provider using a case variant of an existing admin username, exploiting the module's failure to normalize claims before privilege assignment. No public exploit code has been identified at the time of analysis, but the attack is feasible with standard OAuth tooling and an understanding of the target Drupal site's identity provider configuration.