CVE-2010-3686

Drupal - Authentication Bypass

Title source: rule

Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

References (6)

Scores

EPSS 0.0063
EPSS Percentile 70.0%

Classification

CWE
CWE-287
Status draft

Affected Products (32)

drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
drupal/drupal
... and 17 more

Timeline

Published Sep 29, 2010
Tracked Since Feb 18, 2026