SA-CONTRIB-2026-284: Critical severity composer/drupal/oauth_login_oauth2 vulnerability
This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an attacker log in as any existing user whose email address they know. This vulnerability is mitigated by the fact that an attacker must have an account with an identity provider the site is configured to use. They must also be able to set the value of at least one attribute that provider returns, such as a username.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/oauth_login_oauth2to a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must have an account with an identity provider configured for the site. They must also be able to set the value of at least one attribute returned by that provider, such as a username.
Which users could be targeted?
An attacker can log in as any existing user whose email address they know, if the required identity-provider conditions are met.
Are sites without a configured OAuth 2.0 or OpenID Connect identity provider exposed through this attack path?
The described attack requires an account at an identity provider that the site is configured to use. The provided information does not describe exploitation where no such configured provider exists.