Project: 
Drupal OAuth & OpenID Connect Login - OAuth2 Client SSO Login
Date: 
2019-February-13
Security risk: 
Critical 17∕25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All
Vulnerability: 
Multiple Vulnerabilities
Description: 

This module enables you to allow login into the Drupal websites through an external provider over the OAuth 2.0 protocol.

The module sets a Drupal variable used for redirection based on unsanitised user input, leading to an Open Redirect vulnerability. It also fails to sanitise user input which is displayed as part of an error message by a test authentication endpoint which is accessible by anonymous users, leading to an XSS vulnerability.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: