{"id":"DRUPAL-CONTRIB-2026-287","aliases":["CVE-2026-118554"],"title":"The module enables authentication via the OpenID Connect (oAuth2) protocol.","titleSource":"OSV","descriptionSource":"OSV","description":"The module enables authentication via the OpenID Connect (oAuth2) protocol.\n\nWhen a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.\n\nThis vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.","severity":"unknown","score":null,"published":"2026-10-28T17:37:54.000Z","modified":"2026-10-30T03:08:38.343Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/oidc","sources":[{"name":"OSV · DRUPAL-CONTRIB-2026-287","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-287"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.3.1"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<2.3.1"}}],"versions":[],"fixed":["2.3.1"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2026-287"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-287","modified":"2026-10-28T18:15:03.982040586Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-287"},{"name":"CVE","id":"CVE-2026-118554","modified":"2026-10-30T03:08:38.343Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118554"}],"assessments":[],"cve":{"records":[{"id":"CVE-2026-118554","source":"drupal","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T15:50:46.718Z","published":"2026-10-30T03:08:38.343Z","modified":"2026-10-30T03:08:38.343Z"}],"publishers":[{"name":"drupal","role":"CNA","organizationId":"2c85b837-eb8b-40ed-9d74-228c62987387","modified":"2026-10-30T03:08:38.343Z"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-287","tags":[],"source":"drupal"}],"weaknesses":[{"id":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","source":"drupal"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"Drupal","name":"OpenID Connect Client","platforms":[],"versions":[{"version":"0.0.0","status":"affected","lessThan":"2.3.1","versionType":"semver"}],"cpes":[],"source":"drupal","url":"https://www.cve.org/CVERecord?id=CVE-2026-118554"}],"remediation":[],"observedAt":"2026-10-30T03:39:17.333Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:15:31.262Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-28T18:50:35.805Z","attemptedAt":"2026-10-28T18:50:35.805Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T18:50:35.788Z","attemptedAt":"2026-10-28T18:50:35.788Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-28T18:50:33.551Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T18:50:36.134Z","attemptedAt":"2026-10-28T18:50:36.134Z"}],"evidence":[],"aiSummary":null}