Vulnerability-Lookup

CVE-2026-3530 (GCVE-0-2026-3530)

Vulnerability from cvelistv5 – Published: 2026-03-26 20:03 – Updated: 2026-03-26 20:03

Title

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

Summary

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

Severity ?

No CVSS data available.

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

drupal

References

URL

Tags

https://www.drupal.org/sa-contrib-2026-025

Impacted products

	Vendor	Product	Version
	Drupal	OpenID Connect / OAuth client	Affected: 0.0.0 , < 1.5.0 (semver)

Date Public ?

2026-03-04 18:00

Credits

Drew Webber (mcdruid) Drew Webber (mcdruid) Philip Frilling (pfrilling) Damien McKenna (damienmckenna) Greg Knaddison (greggles) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/openid_connect",
          "defaultStatus": "unaffected",
          "product": "OpenID Connect / OAuth client",
          "repo": "https://git.drupalcode.org/project/openid_connect",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.5.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Philip Frilling (pfrilling)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-03-04T18:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.\u003cp\u003eThis issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.\u003c/p\u003e"
            }
          ],
          "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T20:03:39.756Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-025"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-3530",
    "datePublished": "2026-03-26T20:03:39.756Z",
    "dateReserved": "2026-03-04T16:41:58.794Z",
    "dateUpdated": "2026-03-26T20:03:39.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3530\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2026-03-26T21:17:09.150\",\"lastModified\":\"2026-03-26T21:17:09.150\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.\"}],\"metrics\":{},\"weaknesses\":[{\"source\":\"mlhess@drupal.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://www.drupal.org/sa-contrib-2026-025\",\"source\":\"mlhess@drupal.org\"}]}}"
  }
}

FKIE_CVE-2026-3530

Vulnerability from fkie_nvd - Published: 2026-03-26 21:17 - Updated: 2026-03-26 21:17

Severity ?

Summary

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

References

	URL	Tags
	mlhess@drupal.org	https://www.drupal.org/sa-contrib-2026-025

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0."
    }
  ],
  "id": "CVE-2026-3530",
  "lastModified": "2026-03-26T21:17:09.150",
  "metrics": {},
  "published": "2026-03-26T21:17:09.150",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "url": "https://www.drupal.org/sa-contrib-2026-025"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "mlhess@drupal.org",
      "type": "Secondary"
    }
  ]
}

drupal-contrib-2026-025

Vulnerability from drupal

Published

2026-03-04 18:00

Modified

2026-03-04 18:00

Summary

Details

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.

The module doesn't sufficiently validate certain fields coming from the identity provider, which could lead to SSRF and information disclosures.

This vulnerability is mitigated by:
- an attacker must have access to the identity provider to provide compromised data at the source profile.
- a site must have specific field mappings configured

Credits

Drew Webber (mcdruid) www.drupal.org/u/mcdruid

References

URL

Type

https://www.drupal.org/sa-contrib-2026-025

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.5.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/openid_connect"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.5.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-3530"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/mcdruid"
      ],
      "name": "Drew Webber (mcdruid)"
    }
  ],
  "details": "This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.\n\nThe module doesn\u0027t sufficiently validate certain fields coming from the identity provider, which could lead to SSRF and information disclosures.\n\nThis vulnerability is mitigated by:  \n- an attacker must have access to the identity provider to provide compromised data at the source profile.  \n- a site must have specific field mappings configured",
  "id": "DRUPAL-CONTRIB-2026-025",
  "modified": "2026-03-04T18:00:41.000Z",
  "published": "2026-03-04T18:00:41.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-025"
    }
  ],
  "schema_version": "1.7.0"
}

GHSA-2MQ5-FR5W-RR29

Vulnerability from github – Published: 2026-03-26 21:31 – Updated: 2026-03-26 21:31

Details

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-3530"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-26T21:17:09Z",
    "severity": null
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.",
  "id": "GHSA-2mq5-fr5w-rr29",
  "modified": "2026-03-26T21:31:28Z",
  "published": "2026-03-26T21:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3530"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-3530 (GCVE-0-2026-3530)

FKIE_CVE-2026-3530

drupal-contrib-2026-025

Vulnerability from drupal

GHSA-2MQ5-FR5W-RR29

Tags

Sightings

Nomenclature