CVE-2025-12466 Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114
Attackers can bypass authentication in the Drupal Simple OAuth module, gaining unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12466?
CVE-2025-12466 is a high-severity authentication bypass vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
Weakness: CWE-288
Which versions are affected by CVE-2025-12466?
2 open source packages ship an affected version, including drupal/simple_oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/simple_oauth Packagist | From 6.0.0 | 6.0.7 |
drupal/simple_oauth Packagist | From 6.0.0 | 6.0.7 |
Linux distribution packages (1)
drupal/simple_oauth Packagist:https://packages.drupal.org/8 | From 6.0.0 | 6.0.7 |
Products include Simple Oauth Project Simple Oauth.
How do I fix CVE-2025-12466?
Upgrade drupal/simple_oauth to 6.0.7 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-12466 being exploited?
There is no known exploitation of CVE-2025-12466 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2025-114, GHSA-jqmq-fpwv-p925.