| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/social_auth_entra_id | < 1.0.4 | 1.0.4 |
| microsoft entra id sso login | < 1.0.4 | 1.0.4 |
This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0.
The module doesn't sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free