Drupal Simple OAuth and OpenID Connect Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the Drupal Simple OAuth (OAuth2) and OpenID Connect modules, specifically in versions 6.0.0 prior to 6.0.7. This vulnerability allows access bypass by not properly enforcing granted scopes, which can affect access checks based on user roles. For instance, routes requiring specific roles can be accessed without the necessary permissions if an access token is used.

Impact

Exploitation of this vulnerability allows for unauthorized access to routes and resources that require specific user roles, potentially leading to unauthorized actions or data access.

Remediation

Users of the affected Drupal Simple OAuth (OAuth2) and OpenID Connect modules should upgrade to version 6.0.7.