CVE-2026-3530

Name of the Vulnerable Software and Affected Versions Drupal OpenID Connect / OAuth client versions prior to 1.5.0

Description A Server-Side Request Forgery (SSRF) issue exists in the OpenID Connect / OAuth client module of Drupal. This flaw stems from insufficient validation of data received from the identity provider. Successful exploitation could lead to Server Side Request Forgery and information disclosure. An attacker must have access to the identity provider and the site must have specific field mappings configured for exploitation.

Recommendations Update to version 1.5.0 or later.