Philip Frilling

A Server-Side Request Forgery (SSRF) issue exists in the OpenID Connect / OAuth client module of Drupal. This flaw stems from insufficient validation of data received from the identity provider. Successful exploitation could lead to Server Side Request Forgery and information disclosure. An attacker must have access to the identity provider and the site must have specific field mappings configured for exploitation.

A flaw exists in the OpenID Connect / OAuth client module that could allow for authentication bypass. Specifically, if a user successfully authenticates with their Identity Provider but is denied access to Drupal due to custom code or a server error, their session remains active at the Identity Provider. This can potentially lead to unauthorized access, particularly in shared computing environments, where a user who initially failed to authenticate may gain access through an alternate path.

A flaw exists in the OpenID Connect / OAuth client module that allows for privilege escalation due to improper handling of case sensitivity. The module does not adequately validate the uniqueness of user fields, potentially allowing a user to register with an email address already associated with another account. This can lead to data integrity issues when a user signs in for the first time.