CVE-2026-3531: OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026
Published Mar 26, 2026
·Updated
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
Affected Software
2 affected components
drupal/openid_connect<1.5.0
Bojanz Openid Connect \/ Oauth Client Drupal<8.x-1.5
Event History
Mar 26, 2026
CVE Published
via MITRE·08:03 PM
Data Sourced
via MITRE·08:03 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-3531?
CVE-2026-3531 is classified as moderately critical due to its potential for access bypass.
2
How do I fix CVE-2026-3531?
To fix CVE-2026-3531, update the OpenID Connect / OAuth client to version 1.5.0 or later.
3
What causes CVE-2026-3531?
CVE-2026-3531 is caused by an authentication bypass vulnerability that allows access through alternate paths or channels.
4
Which software versions are affected by CVE-2026-3531?
CVE-2026-3531 affects the OpenID Connect / OAuth client versions prior to 1.5.0.
5
Is CVE-2026-3531 applicable to my Drupal site?
If your Drupal site is using an affected version of the OpenID Connect / OAuth client, it is at risk of CVE-2026-3531.