Critical Authorization Flaw in Drupal OAuth2 Server: Forceful Browsing Risk
Summary
CVE-2025-31691: Drupal OAuth2 Server Missing Authorization vulnerability. Affects drupal/oauth2_server versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal OAuth2 Server is a widely used package that facilitates OAuth2 authentication for Drupal applications. It allows developers to implement secure authorization mechanisms, enabling users to grant third-party applications limited access to their resources without exposing their credentials. However, the package has been found to have a critical vulnerability that could allow unauthorized users to access restricted resources, posing a significant security risk.
Vulnerability Detail
The vulnerability in the Drupal OAuth2 Server arises from a missing authorization check, which can lead to forceful browsing. This means that an attacker could potentially access sensitive resources or data without proper authentication. The issue affects versions from 0.0.0 up to, but not including, 2.1.0. The lack of proper authorization checks can lead to unauthorized access, data leaks, and compromise of user privacy.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
composer require drupal/oauth2_server:2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability without updating the package. It is highly recommended to apply the patch as soon as possible to prevent any potential exploitation.
Conclusion
The missing authorization vulnerability in the Drupal OAuth2 Server poses a significant risk to applications using this package. It is crucial to update to version 2.1.0 or later to ensure proper authorization checks are in place. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for drupal/oauth2_server →
FAQ
The vulnerability is a missing authorization check that allows unauthorized users to access restricted resources, leading to potential data breaches.
The vulnerability affects all versions from 0.0.0 up to, but not including, 2.1.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to fix this vulnerability could lead to unauthorized access to sensitive data, compromising user privacy and application integrity.
There are no effective workarounds to mitigate this risk without updating to the patched version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/oauth2_server.
