View online: https://www.drupal.org/sa-contrib-2026-287 Project: OpenID Connect Client [1] Project machine name: oidc Date: 2026-October-28 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper authentication Affected versions: <2.3.1 CVE IDs: CVE-2026-118554 Description: The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user. This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user. Solution: Install the latest version: * Upgrade to OpenID Connect Client 2.3.1 [3]. Linking new users to an existing account is now disabled by default and can be re-enabled on the settings page. When using a generic realm it's also highly recommended to configure the email verified claim. Reported By: * Sanjeev Kumar (ksanjeev284) [4] Fixed By: * Matthijs Van Assche (matthijs) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/oidc [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/oidc/releases/2.3.1 [4] https://www.drupal.org/u/ksanjeev284 [5] https://www.drupal.org/u/matthijs [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....