CVE-2026-118572 in OAuth Login
Summary
by MITRE • 10/30/2026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability represents a critical authentication bypass flaw within the Drupal OAuth Login module, specifically affecting versions ranging from initial releases up through version 3.1.1. This security defect is categorized under CWE-287, which denotes Improper Authentication, and more specifically aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it allows an attacker to bypass standard authentication mechanisms by exploiting alternative pathways or channels within the application logic. The core issue stems from a failure in the module's validation of identity assertions during the OpenID Connect (OIDC) Single Sign-On process. When a user attempts to log in via an external OAuth provider, the system is designed to verify that the incoming token corresponds to a legitimate and authorized session. However, due to insufficient checks on the authentication path or channel used for this verification, it becomes possible for malicious actors to manipulate the flow of data such that the application accepts credentials without performing the requisite integrity checks against the primary identity provider.
From a technical perspective, the vulnerability arises because the module does not strictly enforce binding between the OAuth state parameter and the specific login request context in all code paths. In standard OIDC flows, the client must ensure that the authorization response matches the initial request by validating state parameters to prevent cross-site request forgery attacks and authentication bypasses. If this validation is incomplete or if there exists an alternate entry point where these checks are skipped or improperly implemented, an attacker can craft a malicious redirect URL or manipulate token claims to impersonate other users. This effectively allows unauthorized access to user accounts without possessing valid credentials for those specific identities. The flaw leverages the trust relationship between Drupal and the external identity provider, turning this security feature into a vector for privilege escalation or account takeover depending on the permissions associated with the targeted account.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of user data hosted within the affected Drupal instances. Attackers can gain unauthorized access to administrative accounts if such credentials are linked via OAuth, potentially leading to full site compromise, defacement, or installation of malicious modules that establish persistent backdoors. Even for standard users, the ability to bypass authentication means personal information, private messages, and sensitive content become accessible to adversaries. This undermines the fundamental security model of web applications relying on third-party identity providers, eroding trust in the platform's ability to protect user identities. Furthermore, because this is an authentication bypass rather than a simple injection or execution flaw, it may evade traditional signature-based intrusion detection systems that focus on payload delivery rather than logic flaws in access control mechanisms.
Mitigation strategies must prioritize immediate remediation by upgrading the Drupal OAuth Login module to version 3.1.2 or later, where this specific path validation issue has been addressed through stricter enforcement of state parameter binding and enhanced logging for audit trails. Administrators should also implement multi-factor authentication (MFA) at the application level as a compensating control, ensuring that even if an attacker successfully bypasses the initial OAuth check, they cannot complete the login without secondary verification. Additionally, organizations should review their identity provider configurations to ensure that strict redirect URI validation is enabled and that only trusted domains are permitted for callback URLs. Regular security audits focusing on authentication flows and penetration testing of SSO integrations can help identify similar logic flaws in other modules or custom code before they are exploited in the wild.