CVE-2025-12466
2 advisories.
Packagist/drupal/simple_oauth CVE-2025-12466: high 7.5, EPSS 0.36%
Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass
Action: Upgrade drupal/simple_oauth to 6.0.7 or later.
composer require drupal/simple_oauth:6.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.0.7 | - |
Fixed versions
| 6.0.7 |
Sources
- osv: GHSA-jqmq-fpwv-p925
- https://nvd.nist.gov/vuln/detail/CVE-2025-12466
- https://www.drupal.org/sa-contrib-2025-114
CVE-2025-12466 · published · modified · JSON
Packagist/drupal/simple_oauth CVE-2025-12466: high 7.5, EPSS 0.36%
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.
Action: Upgrade drupal/simple_oauth to 6.0.7 or later.
composer require drupal/simple_oauth:6.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.0.7 | - |
Fixed versions
| 6.0.7 |
Sources
CVE-2025-12466 · published · modified · JSON