Simple Oauth
Monthly
Authentication bypass in Drupal's Simple OAuth (OAuth2) & OpenID Connect contrib module (versions 6.0.0 up to, but not including, 6.0.7) lets unauthenticated remote attackers reach protected functionality through an alternate authentication path, exposing high-confidentiality data per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only sites that run the affected module version range and expose its OAuth2/OpenID Connect endpoints are in scope; sites already on 6.0.7+ or not using the module are unaffected. Exploitation is not confirmed as active - no public exploit has been identified at time of analysis - and EPSS is low (0.36%, 28th percentile), so this is a genuine but not emergency-level priority, and a vendor patch is already available.
Authentication bypass in Drupal's Simple OAuth (OAuth2) & OpenID Connect contrib module (versions 6.0.0 up to, but not including, 6.0.7) lets unauthenticated remote attackers reach protected functionality through an alternate authentication path, exposing high-confidentiality data per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only sites that run the affected module version range and expose its OAuth2/OpenID Connect endpoints are in scope; sites already on 6.0.7+ or not using the module are unaffected. Exploitation is not confirmed as active - no public exploit has been identified at time of analysis - and EPSS is low (0.36%, 28th percentile), so this is a genuine but not emergency-level priority, and a vendor patch is already available.