SA-CONTRIB-2026-290: Critical severity composer/drupal/oauth2_token_manager vulnerability
This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to an account they control. This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/oauth2_token_managerto a version that resolves this vulnerability.Fixed in 8.x-1.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the OAuth2 state value from a previous system token initialization. The advisory gives server access logs as an example location where that value could be obtained.
Are anonymous visitors affected by the missing access restriction?
Yes. The OAuth2 routes do not restrict access, so an anonymous visitor could potentially connect the site's integration to an account they control if they have the required state value.
What should be reviewed to assess whether state values may have been exposed?
Review server access logs for OAuth2 state values generated during system token initialization. The advisory identifies those logs as a possible source an attacker could use to obtain the required value.