Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2025-12466Drupal Simple OAuth/OIDC auth bypass via an alternate path

high
Product: Drupal Simple OAuth / OIDCVendor: DrupalDisclosed: 2025-10-15Status: PatchedProtocol deep diveNVD ↗

What broke

Drupal's Simple OAuth / OIDC module (6.0.0-6.0.6) enforced authentication on the primary path and forgot an alternate one. Patched in 6.0.7.

Why it matters

Alternate-path bypasses are the cousin of the OAuth2-Proxy query-string skip (CVE-2025-54576) and the SmarterMail KEV item (CVE-2026-23760). The control exists. The attacker walks around it. CMS and mail admin planes keep failing this test.

What to do

  • Update Simple OAuth to 6.0.7 or later.
  • When you add a new route to an OAuth-protected Drupal app, add it to the same auth gate. Tests should hit aliases, not only the canonical path.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.