- Package
- drupal/oidc
- Fixed in
- 2.3.1
- Published
- Wed 28 Oct 2026, 17:37 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
An attacker can take over an existing Drupal account when logging in as a new user through OpenID Connect, because the module links accounts with the same email address. The account must not already be linked to an OpenID Connect user, and user 1 is excluded. This requires the site to use a provider that does not verify users' email addresses.
Am I affected?
Look for drupal/oidc and its version in composer.lock. The advisory lists 2.3.1 as fixed but gives no affected version range. Check whether your site uses an OpenID Connect provider that does not verify users' email addresses, and whether existing Drupal accounts other than user 1 remain unlinked to OpenID Connect users.
What to do
Check which version you have, then update to a fixed release for your branch (2.3.1):
composer show drupal/oidc | grep versions
composer update drupal/oidcIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Use an OpenID Connect provider that verifies users' email addresses.
The advisory's description
The module enables authentication via the OpenID Connect (oAuth2) protocol.
When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.
This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.