The Drupal OpenID Connect / OAuth client module contains an improper handling of case sensitivity that allows an attacker to bypass authentication checks. This flaw is a CWE‑178 violation and can be exploited to attain privileges higher than those originally granted. As a result, an attacker controlling authentication requests can achieve privilege escalation on a Drupal site.

Drupal sites that use the OpenID Connect / OAuth client module versions older than 1.5.0 are affected. The vulnerability applies to all releases from the initial 0.0.0 up to, but not including, 1.5.0.

The CVSS base score of 4.2 indicates a moderate severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to manipulate the authentication flow of the OAuth client, likely by sending requests that differ only in case, to trigger the bypass. Because the flaw lies in the client’s input processing, exploitation requires access to the identity provider integration or direct control over the module’s authentication inputs, which limits the scope of potential attacks.