This vulnerability allows an attacker to bypass the standard authentication flow in the Microsoft Entra ID SSO Login integration for Drupal by using an alternate path or channel, thereby achieving higher privileges than originally intended. The weakness is related to inadequate control of authentication mechanisms (CWE‑288). The result is that an attacker can authenticate as a privileged user without providing valid credentials.

Drupal users running the Microsoft Entra ID SSO Login module before version 1.0.4 are vulnerable. The affected module versions span from the initial release (0.0.0) through the pre‑1.0.4 series.

The CVSS score is 6.5, indicating a moderate level of severity. The EPSS score is less than 1%, signaling that exploitation is expected to be rare at this time. This issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, likely through web requests to the SSO endpoint, and requires no special privileges or prior access. An attacker can trigger the bypass by crafting a request that follows the unvalidated alternate channel.