CVE-2010-3686

Name of the Vulnerable Software and Affected Versions Drupal OpenID module versions prior to 6.18 Drupal OpenID module 5.x versions prior to 5.x-1.4

Description The issue concerns the OpenID module in Drupal, which fails to adhere to the OpenID 2.0 protocol. Specifically, it does not ensure that fields are signed, allowing remote attackers to bypass authentication. This can be achieved by leveraging an assertion from an OpenID provider.

Recommendations For Drupal 6.x, update to version 6.18 or later to resolve the issue. For Drupal 5.x, update the OpenID module to version 5.x-1.4 or later to resolve the issue.