{"action":"Upgrade drupal/simple_oauth to 6.0.7 or later.","affected":[{"fixed":"6.0.7","introduced":"6.0.0"}],"component":"drupal/simple_oauth","cve_ids":["CVE-2025-12466"],"ecosystem":"Packagist","epss":0.0036,"exploited":false,"fixed_versions":["6.0.7"],"ghsa_id":"GHSA-jqmq-fpwv-p925","id":"tcs_01M5KF4SZF3Y63ENB1APDP63T8","modified_at":"2025-12-10T23:41:08.954113Z","published_at":"2025-10-30T00:31:04Z","references":["https://osv.dev/vulnerability/GHSA-jqmq-fpwv-p925","https://nvd.nist.gov/vuln/detail/CVE-2025-12466","https://www.drupal.org/sa-contrib-2025-114"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jqmq-fpwv-p925","url":"https://osv.dev/vulnerability/GHSA-jqmq-fpwv-p925"}],"summary":"Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass"}