An attacker can gain access to a Drupal site without valid credentials by exploiting an alternate authentication path or channel within the OpenID Connect / OAuth client module. The flaw allows unauthorized users to impersonate legitimate accounts and potentially reach restricted or administrative functions.

Drupal site owners using the OpenID Connect / OAuth client module in any version released before 1.5.0, including the initial 0.0.0 releases, are affected. Upgrading to 1.5.0 or later resolves the issue.

The vulnerability carries a severity score of 6.5, indicating moderate risk. Exploitation likelihood is reported to be below one percent, and it has not been recorded in the known exploited vulnerabilities catalog. An attacker would most likely reach the vulnerable endpoint via a web request, so remote exploitation through the exposed OAuth client is possible and could lead to privilege escalation if left unpatched.