SA-CONTRIB-2026-287: Critical severity composer/drupal/oidc vulnerability
The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user. This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/oidcto a version that resolves this vulnerability.Fixed in 2.3.1
Event History
Frequently Asked Questions
Which accounts are at risk?
Existing Drupal accounts other than user 1 are at risk if they have not yet been linked to an OpenID Connect user. The issue occurs when a new OpenID Connect login has the same email address as an existing account.
What configuration is required for exploitation?
The site must be configured to use an OpenID Connect provider that does not verify users' email addresses. An attacker would need to authenticate through that provider using an email address matching an unlinked existing Drupal account.
Are sites using an email-verifying OpenID Connect provider affected?
The provided information identifies use of a provider that does not verify email addresses as the mitigating condition. It does not indicate that exploitation is possible when the configured provider verifies email addresses.