{"id":"CVE-2026-118554","kind":"vulnerability","aliases":["CVE-2026-118554"],"related":[],"title":"Drupal OpenID Connect Client: authentication bypass through an alternate login path","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.","summary":"The Drupal OpenID Connect Client module contains an authentication bypass that uses an alternate path or channel to skip normal login checks. A remote attacker may be able to access a Drupal site without valid credentials.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","openid-connect","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the OpenID Connect Client module (`drush pm:list | grep openid`, or the module's info file) and see whether it is `2.3.1` or earlier.\n- Check whether the site uses OpenID Connect login at all in the module settings.","fix":"- Move the OpenID Connect Client module to a version later than `2.3.1`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-30T04:18:20+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:24+00:00","updated_at":"2026-10-30T04:29:24+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move the OpenID Connect Client module to a version later than `2.3.1`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Drupal OpenID Connect Client: authentication bypass through an alternate login path","impact":"high","summary":"The Drupal OpenID Connect Client module contains an authentication bypass that uses an alternate path or channel to skip normal login checks. A remote attacker may be able to access a Drupal site without valid credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","openid-connect","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker logs in to the site without valid credentials","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the exact trigger conditions and the required configuration.","how_to_check":"- Check the installed version of the OpenID Connect Client module (`drush pm:list | grep openid`, or the module's info file) and see whether it is `2.3.1` or earlier.\n- Check whether the site uses OpenID Connect login at all in the module settings.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the OpenID Connect Client module at version 2.3.1 or earlier are in scope according to the NVD entry. The sources do not describe the exact configuration needed to trigger the bypass, so sites without this module or with a newer version can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4107,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118554':14A,17A '-2026':13A,16A '0.0.0':87C '2.3.1':89C 'abl':53B 'access':55B 'affect':81C 'allow':76C 'altern':9A,39B,66C 'attack':50B 'authent':5A,34B,62C,77C 'bypass':6A,35B,63C,78C 'channel':42B,69C 'check':47B 'client':4A,30B,75C,84C 'connect':3A,21B,29B,74C,83C 'contain':32B 'credenti':61B 'cve':12A,15A 'drupal':1A,18B,27B,57B,72C 'host':25B 'issu':80C 'login':10A,46B 'may':51B 'modul':31B 'normal':45B 'openid':2A,20B,28B,73C,82C 'openid-connect':19B 'packag':22B 'path':11A,40B,67C 'remot':49B 'self':24B 'self-host':23B 'site':58B 'skip':44B 'use':37B,64C 'valid':60B 'version':85C 'vulner':70C 'without':59B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the OpenID Connect Client module at version 2.3.1 or earlier are in scope according to the NVD entry. The sources do not describe the exact configuration needed to trigger the bypass, so sites without this module or with a newer version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118554","severity":null,"published_at":"2026-10-30T04:18:20+00:00","modified_at":"2026-10-30T04:18:20+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}