GitHub Advisoryadvisory · Packagist

GHSA-jqmq-fpwv-p925 Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass

HIGH Published 2025-10-30 Modified 2025-10-30 Official page ↗
Aliases
CVE-2025-12466
Ecosystem
Packagist
Packages
drupal/simple_oauth
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-288
Reviewed
2025-10-30

Affected packages

• Packagist drupal/simple_oauth: >= 6.0.0, < 6.0.7 → fixed in 6.0.7

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass. This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.

Related

Alias · CVE (1)

  • CVE-2025-12466 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows… vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References