PT-2026-120915

CVE-2026-114542

Published

2026-10-21

Updated

2026-10-30

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Simple OAuth (OAuth2) & OpenID Connect versions 6.1.0 through 6.1.3

Description Incorrectly configured access control security levels allow the caching of token permissions in a manner that enables them to be reused for another user's token sharing the same scopes. This can lead to a user gaining unauthorized permissions, including administrative access. Exploitation requires a more privileged user's token with identical scopes to be used first.

Recommendations Update Drupal Simple OAuth (OAuth2) & OpenID Connect to a version newer than 6.1.3.

Exploitability

Exploit

Fix

Researchers