{"id":"CVE-2026-114542","kind":"vulnerability","aliases":["CVE-2026-114542"],"related":[],"title":"Drupal Simple OAuth: browser cache can expose sensitive token data","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.","summary":"Simple OAuth (OAuth2) & OpenID Connect for Drupal versions 6.1.0 to 6.1.3 can cause sensitive information to be stored in the web browser cache. An attacker with access to a shared or local browser cache may be able to read that data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","oauth2","openid-connect","package","simple-oauth"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed version of the `drupal/simple_oauth` module with `composer show drupal/simple_oauth` and see whether it falls in `6.1.0` to `6.1.3`.\n- Review the response headers for OAuth and OpenID Connect endpoints for cache-control settings; the sources do not say which headers are affected.","fix":"- Move `drupal/simple_oauth` to a version later than `6.1.3`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T04:18:13+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:53+00:00","updated_at":"2026-10-30T04:29:53+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move `drupal/simple_oauth` to a version later than `6.1.3`; the sources do not name the fixed version.","reach":"unknown","title":"Drupal Simple OAuth: browser cache can expose sensitive token data","impact":"medium","summary":"Simple OAuth (OAuth2) & OpenID Connect for Drupal versions 6.1.0 to 6.1.3 can cause sensitive information to be stored in the web browser cache. An attacker with access to a shared or local browser cache may be able to read that data.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","simple-oauth","oauth2","openid-connect"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive data readable from cached browser responses","analyst_note":"Check the Drupal security advisory for the affected endpoints, the fixed version, and the precise cache-control issue; NVD text is sparse.","how_to_check":"- Check the installed version of the `drupal/simple_oauth` module with `composer show drupal/simple_oauth` and see whether it falls in `6.1.0` to `6.1.3`.\n- Review the response headers for OAuth and OpenID Connect endpoints for cache-control settings; the sources do not say which headers are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Drupal sites that run Simple OAuth (OAuth2) & OpenID Connect between versions 6.1.0 and 6.1.3 are in scope. The sources do not say which endpoints or configurations expose the cached data, so teams should confirm whether their OAuth endpoints return sensitive responses.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000734,"input_tokens":4156,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114542':13A,16A '-2026':12A,15A '6.1.0':34B,101C '6.1.3':36B,103C 'abl':62B 'access':52B,87C 'affect':93C 'allow':83C 'attack':50B 'browser':4A,47B,58B,70C 'cach':5A,48B,59B,71C 'caus':38B 'configur':86C 'connect':21B,30B,82C,98C 'contain':72C 'control':88C 'cve':11A,14A 'data':10A,66B 'drupal':1A,17B,32B,77C 'exploit':84C 'expos':7A 'incorrect':85C 'inform':40B,74C 'issu':92C 'level':90C 'local':57B 'may':60B 'oauth':3A,25B,27B,79C,95C 'oauth2':18B,28B,80C,96C 'openid':20B,29B,81C,97C 'openid-connect':19B 'packag':22B 'read':64B 'secur':89C 'sensit':8A,39B,73C 'share':55B 'simpl':2A,24B,26B,78C,94C 'simple-oauth':23B 'store':43B 'token':9A 'use':67C 'version':33B,99C 'vulner':75C 'web':46B,69C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run Simple OAuth (OAuth2) & OpenID Connect between versions 6.1.0 and 6.1.3 are in scope. The sources do not say which endpoints or configurations expose the cached data, so teams should confirm whether their OAuth endpoints return sensitive responses.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114542","severity":null,"published_at":"2026-10-30T04:18:13+00:00","modified_at":"2026-10-30T04:18:13+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}