| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/oidc | < 2.3.1 | 2.3.1 |
The module enables authentication via the OpenID Connect (oAuth2) protocol.
When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.
This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free