{"id":"CVE-2026-118572","kind":"vulnerability","aliases":["CVE-2026-118572"],"related":[],"title":"Drupal OAuth Login module: authentication bypass via alternate path","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.","summary":"The Drupal OAuth Login - OAuth OIDC SSO module has an authentication bypass flaw that lets a user log in without going through the intended sign-in path. An attacker who uses the alternate channel can gain access to accounts on affected sites.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","oauth","oidc","package","sso"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the OAuth Login - OAuth OIDC SSO module in the Drupal project (for example with `drush pm:list` or the module list at /admin/modules) and compare it with the affected range.\n- Confirm whether the module is enabled on the site.","fix":"- OAuth Login - OAuth OIDC SSO: versions after `3.1.1` are in the affected range per the source; the fixed version is unknown.","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:09+00:00","updated_at":"2026-10-30T04:29:09+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:09Z","model":"claude-haiku-5-5","output":{"fix":"- OAuth Login - OAuth OIDC SSO: versions after `3.1.1` are in the affected range per the source; the fixed version is unknown.","reach":"internet","title":"Drupal OAuth Login module: authentication bypass via alternate path","impact":"high","summary":"The Drupal OAuth Login - OAuth OIDC SSO module has an authentication bypass flaw that lets a user log in without going through the intended sign-in path. An attacker who uses the alternate channel can gain access to accounts on affected sites.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","oauth","oidc","sso"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker logs in as another user, gaining account access","analyst_note":"Find the fixed version and the exact trigger condition in the NVD entry or the Drupal security advisory for OAuth Login - OAuth OIDC SSO.","how_to_check":"- Check the installed version of the OAuth Login - OAuth OIDC SSO module in the Drupal project (for example with `drush pm:list` or the module list at /admin/modules) and compare it with the affected range.\n- Confirm whether the module is enabled on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the OAuth Login - OAuth OIDC SSO module installed at version 3.1.1 or earlier, where it handles single sign-on logins. Sites without this module, or running a newer version, are not affected. The sources do not describe the exact configuration needed to trigger the bypass.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4134,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118572':12A,15A '-2026':11A,14A '0.0.0':93C '3.1.1':95C 'access':58B 'account':60B 'affect':62B,85C 'allow':80C 'altern':8A,54B,68C 'attack':50B 'authent':5A,31B,64C,81C 'bypass':6A,32B,65C,82C 'channel':55B,71C 'cve':10A,13A 'drupal':1A,16B,22B,74C 'flaw':33B 'gain':57B 'go':41B 'intend':44B 'issu':84C 'let':35B 'log':38B 'login':3A,24B,76C,87C 'modul':4A,28B 'oauth':2A,17B,23B,25B,75C,77C,86C,88C 'oidc':18B,26B,78C,89C 'packag':19B 'path':9A,48B,69C 'sign':46B 'sign-in':45B 'site':63B 'sso':20B,27B,79C,90C 'use':52B,66C 'user':37B 'version':91C 'via':7A 'vulner':72C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the OAuth Login - OAuth OIDC SSO module installed at version 3.1.1 or earlier, where it handles single sign-on logins. Sites without this module, or running a newer version, are not affected. The sources do not describe the exact configuration needed to trigger the bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118572","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}