CVE-2025-31691
2 advisories.
Packagist/drupal/oauth2_server CVE-2025-31691: critical 9.8, EPSS 0.43%
Drupal OAuth2 Server Missing Authorization vulnerability
Action: Upgrade drupal/oauth2_server to 2.1.0 or later.
composer require drupal/oauth2_server:2.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.0 | - |
Fixed versions
| 2.1.0 |
Sources
- osv: GHSA-4f8q-mwgc-3mwc
- https://nvd.nist.gov/vuln/detail/CVE-2025-31691
- https://git.drupalcode.org/project/oauth2_server
- https://www.drupal.org/sa-contrib-2025-020
CVE-2025-31691 · published · modified · JSON
Packagist/drupal/oauth2_server CVE-2025-31691: unknown, EPSS 0.43%
Provides OAuth2 server functionality based on the oauth2-server-php library.
Action: Upgrade drupal/oauth2_server to 2.1.0 or later.
composer require drupal/oauth2_server:2.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.0 | - |
Fixed versions
| 2.1.0 |
Sources
CVE-2025-31691 · published · modified · JSON