Live › vulnerability › CVE-2026-118554
The Drupal OpenID Connect Client module contains an authentication bypass that uses an alternate path or channel to skip normal login checks. A remote attacker may be able to access a Drupal site without valid credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the OpenID Connect Client module at version 2.3.1 or earlier are in scope according to the NVD entry. The sources do not describe the exact configuration needed to trigger the bypass, so sites without this module or with a newer version can skip it.
No product ranges from the sources yet.
drush pm:list | grep openid, or the module's info file) and see whether it is 2.3.1 or earlier.2.3.1; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.