This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check...

Insufficient access checks on a configuration route and missing checks that an identity provider has verified an email address let an attacker log in as any existing user whose email address they know. The attacker must have an account with an identity provider configured on the site and be able to set at least one attribute it returns, such as a username.

Look for drupal/oauth_login_oauth2 and its version in composer.lock. The advisory lists 3.1.1 as fixed but supplies no affected version range. Check which OAuth 2.0 or OpenID Connect identity providers your site uses, whether an attacker could have an account with one, and whether they could set an attribute that provider returns, such as a username.

The advisory identifies a limiting condition: an attacker must have an account with a configured identity provider and be able to set at least one attribute that provider returns. It gives no configuration change as a workaround.

This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider.

The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an attacker log in as any existing user whose email address they know.

This vulnerability is mitigated by the fact that an attacker must have an account with an identity provider the site is configured to use. They must also be able to set the value of at least one attribute that provider returns, such as a username.