← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 03:09:26 UTC

CVE-2026-114542

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.

Base score5.4/ 10
SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydrupal
Last updatedNov 6, 2026 13:43:38 UTC
PublishedOct 30, 2026 03:09:26 UTC
ReservedOct 21, 2026 17:08:25 UTC

Credits

  • Jonathan Shaw (jonathanshaw)
  • Alexander Varwijk (kingdutch)
  • Mingsong (mingsong)
  • Stephan Huber (stmh)
  • Trevor Bradley (trevorbradley)
  • Bojan Bogdanovic (bojan_dev)
  • Alexander Varwijk (kingdutch)
  • Mingsong (mingsong)
  • Trevor Bradley (trevorbradley)
  • Jonathan Shaw (jonathanshaw)
  • Swan Kalata (akalata)
  • Benji Fisher (benjifisher)
  • Damien McKenna (damienmckenna)
  • Neil Drumm (drumm)
  • Juraj Nemec (poker10)