🔐 CVE Alert

CVE-2026-118573

UNKNOWN 0.0

OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

CWE CWE-862
Vendor drupal
Product oauth2 token manager
Ecosystems
Industries
WebMedia
Published Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for drupal oauth2 token manager

Be the first to know when new unknown vulnerabilities affecting drupal oauth2 token manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / OAuth2 Token Manager
0.0.0 < 1.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-290

Credits

Francesco Pesenti (peximo) Lucas Hedding (heddn) Francesco Pesenti (peximo) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10)