| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/openid_connect | < 1.5.0 | 1.5.0 |
| openid connect / oauth client | < 8.x-1.5 | 8.x-1.5 |
This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.
A visitor who successfully logs in to their Identity Provider and is denied access to Drupal through custom code or a server error will maintain their session at the Identity Provider, possibly leading to access bypass situations, especially in a shared computing environment.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free