CVE-2026-122058: Composer/drupal/simple_oauth vulnerability
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.
The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access.
This vulnerability is mitigated by the fact that an attacker must have a role with the Add consumer entities or Update own consumer entities permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 5.2.6 - Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 6.0.10 - Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 6.1.4
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
An attacker must hold a role with either the Add consumer entities permission or the Update own consumer entities permission. Users without either permission are not identified as able to exploit the issue.
What level of access could an attacker obtain?
A permitted attacker may configure a malicious consumer to obtain tokens with additional privileges and access the site as another user. The potential impact extends up to full administrative access.
What should be reviewed while remediation is pending?
Review which roles have the Add consumer entities and Update own consumer entities permissions, and remove those permissions from untrusted users where possible. Review consumer configurations created or edited by users with those permissions for malicious settings.