high7.5
CVE-2025-12466
Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass
Impact
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass. This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | drupal/simple_oauth | >= 6.0.0, < 6.0.7 | 6.0.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simple Oauth Project | Simple Oauth | from 6.0.0 before 6.0.7 |