# CVE-2026-3531: DRUPAL-CONTRIB-2026-026 - This module enables you to use an external OpenID Connect login provider to authenticate and…

Source: https://junglewise.ai/threats/cve-2026-3531-drupal-contrib-2026-026-this-module-enables-you-to-use-an-external  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04  
License: CC BY 4.0 with a link back

CVE-2026-3531 · Severity: info · Published 2026-03-04

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.

A visitor who successfully logs in to their Identity Provider and is denied access to Drupal through custom code or a server error will maintain their session at the Identity Provider, possibly leading to access bypass situations, especially in a shared computing environment.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Openid Connect](https://junglewise.ai/threats/technologies/drupal-openid-connect). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-3531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3531 being exploited in the wild.

**How severe is CVE-2026-3531?** Informational severity, published 4 March 2026.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Openid Connect ECOSYSTEM:introduced=0,fixed=1.5.0.

**Is there a fix for CVE-2026-3531?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Openid Connect: upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-3531?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Openid Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Openid Connect: upgrade to 1.5.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Openid Connect ECOSYSTEM:introduced=0,fixed=1.5.0

## Identifiers

- CVE-2026-3531
- DRUPAL-CONTRIB-2026-026

## Related threats

- [DRUPAL-CONTRIB-2026-027 - This module enables you to use an external OpenID Connect login provider to authenticate and…](https://junglewise.ai/threats/cve-2026-3532-drupal-contrib-2026-027-this-module-enables-you-to-use-an-external)
- [DRUPAL-CONTRIB-2026-025 - This module enables you to use an external OpenID Connect login provider to authenticate and…](https://junglewise.ai/threats/cve-2026-3530-drupal-contrib-2026-025-this-module-enables-you-to-use-an-external)
- [DRUPAL-CONTRIB-2021-014 - This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity…](https://junglewise.ai/threats/drupal-contrib-2021-014-this-module-allows-users-to-authenticate-66324353)