Live › vulnerability › CVE-2026-114542
Simple OAuth (OAuth2) & OpenID Connect for Drupal versions 6.1.0 to 6.1.3 can cause sensitive information to be stored in the web browser cache. An attacker with access to a shared or local browser cache may be able to read that data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run Simple OAuth (OAuth2) & OpenID Connect between versions 6.1.0 and 6.1.3 are in scope. The sources do not say which endpoints or configurations expose the cached data, so teams should confirm whether their OAuth endpoints return sensitive responses.
No product ranges from the sources yet.
drupal/simple_oauth module with composer show drupal/simple_oauth and see whether it falls in 6.1.0 to 6.1.3.drupal/simple_oauth to a version later than ; the sources do not name the fixed version.6.1.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-114542")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.