CVE-2026-3530: OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025
Published Mar 26, 2026
·Updated
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
Affected Software
2 affected components
Drupal OpenID Connect / OAuth client>=0.0.0<1.5.0
Bojanz Openid Connect \/ Oauth Client Drupal<8.x-1.5
Event History
Mar 26, 2026
CVE Published
via MITRE·08:03 PM
Data Sourced
via MITRE·08:03 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-3530?
CVE-2026-3530 is classified as a moderately critical vulnerability.
2
How does CVE-2026-3530 affect the Drupal OpenID Connect / OAuth client?
CVE-2026-3530 allows for Server Side Request Forgery, which can lead to information disclosure.
3
What versions of the Drupal OpenID Connect / OAuth client are affected by CVE-2026-3530?
CVE-2026-3530 affects versions between 0.0.0 and 1.5.0 of the Drupal OpenID Connect / OAuth client.
4
How do I fix CVE-2026-3530?
To mitigate CVE-2026-3530, you should update the affected Drupal OpenID Connect / OAuth client to a newer version.
5
What type of vulnerability is CVE-2026-3530?
CVE-2026-3530 is characterized as a Server-side Request Forgery (SSRF) vulnerability.