CVE-2026-118554 in OpenID Connect Client
Summary
by MITRE • 10/30/2026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability represents a critical authentication bypass flaw within the Drupal OpenID Connect Client module, specifically affecting version ranges from 0.0.0 through 2.3.1. This security defect is classified under CWE-287, which denotes Improper Authentication, and more specifically aligns with MITRE ATT&CK technique T1556, as it involves modifying or replacing authentication mechanisms to gain unauthorized access. The core of the issue lies in how the module handles identity verification during the OpenID Connect flow, allowing an attacker to circumvent standard credential validation processes by exploiting alternative pathways within the application logic rather than attacking the primary login interface directly.
In a typical OpenID Connect implementation, the relying party Drupal site relies on assertions from an external Identity Provider to establish user sessions securely. The vulnerability arises because the module fails to adequately validate the integrity and origin of authentication tokens or claims when processed through certain alternate code paths. An attacker can manipulate these alternative channels to inject forged identity data that the application accepts as legitimate without requiring valid credentials from the configured OpenID Connect provider. This bypass effectively nullifies the security controls intended to restrict access to authenticated users, allowing unauthorized entities to assume privileged roles within the Drupal environment.
The operational impact of this vulnerability is severe, particularly for sites relying on single sign-on integrations for administrative or sensitive user functions. By exploiting this alternate path, an attacker can gain full control over a user account without possessing valid login credentials. If the targeted account holds administrator privileges, the consequences extend to complete compromise of the web application, including potential data exfiltration, defacement, and further lateral movement within the underlying infrastructure. The flaw undermines the fundamental trust model of federated identity systems, rendering the configured OpenID Connect provider ineffective as a gatekeeper for access control.
Mitigation strategies must prioritize immediate remediation through software updates or configuration changes where patches are unavailable. Administrators should upgrade the Drupal OpenID Connect Client module to version 2.3.2 or later, which addresses the validation logic flaws in these alternate authentication paths. In environments where upgrading is not immediately feasible, temporary mitigations may include restricting access to affected endpoints via web application firewall rules that detect anomalous token structures or unusual request patterns associated with bypass attempts. Additionally, enforcing multi-factor authentication at the Drupal level can provide a secondary layer of defense, ensuring that even if an attacker successfully bypasses the OpenID Connect validation step, they still require additional proof of identity to complete the session establishment process. Continuous monitoring for suspicious login activities and reviewing access logs for anomalies consistent with token manipulation are also recommended to detect potential exploitation attempts in real time.