Description
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | drupal6 | 6.6-3lenny6 | DSA-2113-1 |
Advisories 1
- DSA-2113-1 drupal6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://drupal.org/node/880480
- DSA-2113 vendor-advisory
- [oss-security] 20100913 Re: CVE id requests: drupal mailing-list
- 42388 vdb-entry
- http://drupal.org/node/880476
- [oss-security] 20100911 CVE id requests: drupal mailing-list