CVE-2025-12466

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Drupal	Simple OAuth (OAuth2) & OpenID Connect	>= 6.0.0, < 6.0.7

References

https://www.drupal.org/sa-contrib-2025-114Patch, Vendor Advisory

Timeline

Published: Oct 30, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-124685.3The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive I CVE-2025-124694.3The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Aut CVE-2025-12478.3A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without CVE-2025-124716.1The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the CVE-2025-124727.1An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leadin CVE-2025-124736.1The RTMKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'themebuilder' parameter in all versions up to, and CVE-2025-124744.4A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causi CVE-2025-124756.4The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shor CVE-2025-124769.8Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-124779.8Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-124789.8Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-124798.8Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5