CVE-2025-31691: Drupal OAuth2 Server Missing Authorization vulnerability
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.19596%
CWE
Published
4/1/2025
Updated
4/2/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/oauth2_server | composer | < 2.1.0 | 2.1.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability centers around missing authorization checks for disabled OAuth2 servers. Based on:
- The security advisory explicitly mentions disabled servers still processing authentications
- OAuth2 token endpoints are the primary authentication vector
- The 'isEnabled' status check would be the natural authorization control point
- Drupal's typical controller-based architecture for endpoint handling
While the exact patch isn't available, these functions represent the most likely locations where authorization checks were either missing (in vulnerable versions) or added (in the patch). The TokenController would handle incoming requests, while ServerInterface would manage server status checks - together forming the authorization boundary that was improperly enforced.