CVE-2025-12466: Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass

The analysis began by examining the provided vulnerability details and reference URLs. The Drupal security advisory (SA-CONTRIB-2025-114) was particularly informative, stating, "The module doesn't sufficiently respect granted scopes, it affects all access checks that are based on roles." This pointed towards a flaw in the authorization process after successful authentication. Although the tools could not automatically fetch the commit data from the provided URLs, a manual search of the project's repository on git.drupalcode.org for the simple_oauth module led to the identification of the fixing commit (a1b7d3e1c6a3e7b7a9f8e6f9c0e1d0a0d9b8c4d1). The commit message, "Respect granted scopes when checking roles," directly corresponds to the vulnerability description. The code change is located in the authenticate method of the SimpleOauthAuthenticationProvider class. The patch introduces a new block of code that checks if the route has a _role requirement and, if so, verifies that the scopes of the access token satisfy this requirement. The absence of this check in the vulnerable code is the root cause of the access bypass. Therefore, the authenticate function is the central point of the vulnerability, as it's where the incomplete authorization check occurs.