CVE-2025-31691 OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020
Attackers can bypass authorization checks in the Drupal OAuth2 Server module to access restricted resources without proper permissions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31691?
CVE-2025-31691 is a critical missing authorization vulnerability in Drupal OAuth2 Server, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
Weakness: CWE-862
Which versions are affected by CVE-2025-31691?
2 open source packages ship an affected version, including drupal/oauth2_server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/oauth2_server Packagist | All versions | 2.1.0 |
drupal/oauth2_server Packagist | All versions | 2.1.0 |
Linux distribution packages (1)
drupal/oauth2_server Packagist:https://packages.drupal.org/8 | All versions | 2.1.0 |
Products include Oauth2 Server Project Oauth2 Server.
How do I fix CVE-2025-31691?
Upgrade drupal/oauth2_server to 2.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-31691 being exploited?
There is no known exploitation of CVE-2025-31691 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2025-020, GHSA-4f8q-mwgc-3mwc.