DRUPAL-CONTRIB-2026-296: Composer/drupal/simple_oauth vulnerability
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.
The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access.
This vulnerability is mitigated by the fact that an attacker must have a role with the Add consumer entities or Update own consumer entities permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 5.2.6 - Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 6.0.10 - Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 6.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have a role granted either the Add consumer entities permission or the Update own consumer entities permission. Users without one of those permissions are not described as able to exploit the issue.
What could an attacker achieve?
A permitted attacker could configure a malicious consumer and obtain access tokens with additional privileges. This may let them access the site as another user, potentially including full administrative access.
What should be reviewed while remediation is pending?
Review which roles have the Add consumer entities and Update own consumer entities permissions, and remove those permissions from untrusted users where possible. Review existing consumer configurations for unauthorized or suspicious consumers.