Packagist/drupal/oauth2_server CVE-2025-31691: critical 9.8, EPSS 0.43%

Provides OAuth2 server functionality based on the oauth2-server-php library.

Action: Upgrade drupal/oauth2_server to 2.1.0 or later.

composer require drupal/oauth2_server:2.1.0

Affected

Fixed versions

Sources

• osv: DRUPAL-CONTRIB-2025-020
• nvd: CVE-2025-31691
• https://www.drupal.org/sa-contrib-2025-020

CVE-2025-31691 · published 2025-02-26T18:35:21Z · modified 2026-09-10T03:46:09.150368330Z · JSON