Drupal Simple OAuth (OAuth2) & OpenID Connect exposes a Web Browser Cache Containing Sensitive Information vulnerability that can be exploited when access control security levels are incorrectly configured. The flaw enables an attacker to bypass normal access restrictions and potentially retrieve credentials or tokens that are stored in the browser cache. CWE‑525 underlines that the implementation fails to secure sensitive data during caching, allowing unauthorized disclosure or use.

The vulnerability affects the Drupal Simple OAuth (OAuth2) & OpenID Connect module in Drupal, specifically versions 6.1.0 through 6.1.3. Any Drupal site that has one of these affected module versions installed without remediation is at risk.

The CVSS and EPSS scores are not available and the issue is not listed in CISA KEV, but the potential for sensitive data exposure and access bypass is significant. Attackers would need to interact with the affected web application, likely through a browser session that triggers the cache. Consequently, the exploitation probability depends on the presence of correctly configured access controls, but the impact of exploitation is high if the flaw is present.