SA-CONTRIB-2026-296: Critical severity composer/drupal/simple_oauth vulnerability
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access. This vulnerability is mitigated by the fact that an attacker must have a role with the Add consumer entities or Update own consumer entities permissions.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/simple_oauthto a version that resolves this vulnerability.Fixed in 6.1.4Fixed in 6.0.10Fixed in 5.2.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have a role that includes either the Add consumer entities permission or the Update own consumer entities permission. Users without one of those permissions are not identified as able to exploit the issue.
What level of access could an attacker obtain?
A user able to configure a malicious consumer may obtain tokens with additional privileges and access the site as another user. The impact can extend to full administrative access.
Are sites affected by default?
Exploitation depends on assigning either the Add consumer entities or Update own consumer entities permission to a role. The provided information does not establish whether those permissions are granted in a default configuration.