An SSRF vulnerability exists within the Drupal OpenID Connect / OAuth client module that allows an attacker to cause the server to make HTTP requests to arbitrary destinations. This flaw can lead to the disclosure of private information, internal network resources, or enable further attacks such as bypassing firewall restrictions. The weakness is identified as CWE‑918, which describes server‑side request forgery behaviors.

Drupal installations employing the OpenID Connect / OAuth client module are affected when the module version is from the initial release through 1.4.9. Versions 1.5.0 and higher contain the fix and are not impacted by this issue.

The CVSS score of 4.3 classifies the vulnerability as low severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. It is not present in the CISA KEV catalog. The attack vector is not explicitly stated in the advisory, but it is inferred that an external attacker can trigger the SSRF by supplying a crafted request to the vulnerable module, a typical scenario for SSRF exploits.