🔐 CVE Alert

CVE-2026-118554

UNKNOWN 0.0

OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

CWE CWE-288
Vendor drupal
Product openid connect client
Ecosystems
Industries
WebMedia
Published Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for drupal openid connect client

Be the first to know when new unknown vulnerabilities affecting drupal openid connect client are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / OpenID Connect Client
0.0.0 < 2.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-287

Credits

Sanjeev Kumar (ksanjeev284) Matthijs Van Assche (matthijs) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10)