https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-30T22:29:33.308244+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/drupal-contrib-2026-287 DRUPAL-CONTRIB-2026-287 2026-10-30T22:29:33.318369+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/oidc

The module enables authentication via the OpenID Connect (oAuth2) protocol.

When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.

This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.

 https://db.gcve.eu/vuln/fkie_cve-2026-118554 fkie_cve-2026-118554 2026-10-30T22:29:33.318466+00:00

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

 https://db.gcve.eu/vuln/ghsa-rvvv-5cm6-2jq5 GHSA-rvvv-5cm6-2jq5 2026-10-30T22:29:33.318495+00:00

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4230 WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-30T22:29:33.318511+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.