CVE-2025-12466: This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with a

high Affects drupal/simple_oauth. Feed 2026.10.29.1, updated 2026-10-28; published 2025-10-29; advisory modified 2026-09-10.

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with a

Package: drupal/simple_oauth Composer
Affected versions: >=6.0.0 <6.0.7 or >=6.0.0 and <6.0.7
Fixed in: 6.0.7
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 0% (29.7th percentile)
Published: 2025-10-29
Source: osv.dev

References

CWE-288

NVD record drupal/simple_oauth advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2026-114542 unknown This module introduces an OAuth 2.0 authorization server, which can be configured to prote same package: drupal/simple_oauth
DRUPAL-CONTRIB-2022-002 unknown This module enables you to implement OAuth 2.0 authentication for Drupal. The module does same package: drupal/simple_oauth
CVE-2024-10924 critical The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulner same weakness: CWE-288
CVE-2023-2732 critical The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up same weakness: CWE-288
CVE-2023-2982 critical The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for Wo same weakness: CWE-288
CVE-2023-2986 critical The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authenticati same weakness: CWE-288