DRUPAL-CONTRIB-2026-287: Composer/drupal/oidc vulnerability
The module enables authentication via the OpenID Connect (oAuth2) protocol.
When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.
This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/oidcto a version that resolves this vulnerability.Fixed in 2.3.1
Event History
Frequently Asked Questions
Which accounts are at risk of takeover?
Existing Drupal accounts other than user 1 are at risk if they have not yet been linked to an OpenID Connect user. The issue arises when a new OpenID Connect login has the same email address as an existing account.
What configuration makes exploitation possible?
The site must use an OpenID Connect provider that does not verify users' email addresses. A provider that verifies email addresses mitigates this vulnerability.
What can be done if an update cannot be applied immediately?
Review the configured OpenID Connect provider and ensure it verifies user email addresses. Accounts that are not yet linked to an OpenID Connect user are the relevant accounts to review.