{"action":"Upgrade drupal/simple_oauth to 6.0.7 or later.","affected":[{"fixed":"6.0.7","introduced":"6.0.0"}],"component":"drupal/simple_oauth","cve_ids":["CVE-2025-12466"],"ecosystem":"Packagist","ecosystem_qualifier":"Packagist:https://packages.drupal.org/8","epss":0.0036,"exploited":false,"fixed_versions":["6.0.7"],"ghsa_id":"GHSA-jqmq-fpwv-p925","id":"tcs_01M5MF84JQYNMKBEEM2HDR19YC","modified_at":"2026-09-10T03:46:12.946826161Z","published_at":"2025-10-29T16:44:39Z","references":["https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-114","https://www.drupal.org/sa-contrib-2025-114"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DRUPAL-CONTRIB-2025-114","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-114"},{"source":"nvd","source_id":"CVE-2025-12466","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12466"}],"summary":"This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them."}