Server-Side Request Forgery Vulnerability in Drupal OpenID Connect / OAuth Client
CVE-2026-3530

4.3MEDIUM

Key Information:

Vendor

Drupal
Status
Openid Connect / Oauth Client
Vendor
CVE Published:
26 March 2026

What is CVE-2026-3530?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Drupal OpenID Connect and OAuth client, potentially allowing attackers to send unauthorized requests from the server to internal or external resources, which could lead to data exposure or further exploitation. This vulnerability affects versions of the OpenID Connect / OAuth client prior to 1.5.0, emphasizing the necessity of updating to secure the application from potential threats. For more information, visit the official Drupal security advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

OpenID Connect / OAuth client 0.0.0 < 1.5.0

References

https://www.drupal.org/sa-contrib-2026-025

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Drew Webber (mcdruid)
Philip Frilling (pfrilling)
Damien McKenna (damienmckenna)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
JSON
.