CVE-2026-114542CWE-525

CVE-2026-114542: vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect

Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

Published

Follow this CVE+ Monitor Simple OAuth & OpenID Connect+ Monitor drupal/simple_oauth

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.1%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.
Affected products
Drupal · Simple OAuth (OAuth2) & OpenID Connect
Related CVEs — Drupal Simple OAuth (OAuth2) & OpenID Connect

In the same product, most dangerous first.

CVE-2025-12466HIGHSimple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114EPSS 0.4%