CVE-2025-12466Drupal Simple OAuth/OIDC auth bypass via an alternate path
What broke
Drupal's Simple OAuth / OIDC module (6.0.0-6.0.6) enforced authentication on the primary path and forgot an alternate one. Patched in 6.0.7.
Why it matters
Alternate-path bypasses are the cousin of the OAuth2-Proxy query-string skip (CVE-2025-54576) and the SmarterMail KEV item (CVE-2026-23760). The control exists. The attacker walks around it. CMS and mail admin planes keep failing this test.
What to do
- Update Simple OAuth to 6.0.7 or later.
- When you add a new route to an OAuth-protected Drupal app, add it to the same auth gate. Tests should hit aliases, not only the canonical path.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryFAPI
Financial-grade API. A hardened OAuth and OIDC security profile from the OpenID Foundation for high-risk APIs such as open banking, mandating stronger client au
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- CVESimpleHelp accepts unsigned OIDC tokens, MFA bypass
SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch i