Drupal OpenID Connect/OAuth Client Improper Case Sensitivity Handling Vulnerability Allowing Privilege Escalation

A privilege escalation vulnerability has been identified in the Drupal OpenID Connect/OAuth client, affecting versions prior to 1.5.0. The issue arises from improper handling of case sensitivity, which allows users to register with the same email address as another user, potentially leading to data integrity issues. This vulnerability is categorized as an access bypass.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing users to gain elevated rights or access within the application.

Remediation

Users are advised to upgrade to OpenID Connect version 8.x-1.5. For those affected by this vulnerability, additional guidance is available on the Drupal.org page 'Fixing emails that vary only by case'.