VULNERABILITY INTELLIGENCE

CVE-2010-3686

CVSS score5 MEDIUM
EPSS probability2.37%
CISA KEVNot currently listed
Published2010-09-29
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Weakness classification

  • CWE-287: Improper Authentication

Primary references