Tag1 D7ES Announcements

The OpenID Connect module introduced a prompt parameter configuration that, when misconfigured, could potentially weaken authentication security by allowing users to bypass certain authentication requirements through OpenID Connect identity providers.

The OpenID Connect module contained an email uniqueness validation vulnerability that allowed duplicate user accounts to be created with email addresses that differ only in case, potentially leading to account confusion and authentication bypass scenarios.

The Login Disable module contained an access bypass vulnerability in its user login hook, allowing users to bypass the access key requirement through non-form login routes like Services or RESTful APIs.

The User Alert module contained an Insecure Direct Object Reference (IDOR) vulnerability in its message dismissal endpoint, allowing authenticated users to mark any node as dismissed without proper access control checks.

The Entityreference Filter module exposed an unprotected callback function that allowed unauthorized users to trigger entity reference filter updates without proper access control.

The Ajax Blocks module contained an access bypass vulnerability in its AJAX handler that could serve content from disabled or regionless blocks, potentially exposing content that should not be accessible to users.

The Term Reference Tree Widget module contained a Cross-Site Scripting (XSS) vulnerability in its tree list output function, allowing malicious users to inject JavaScript code through unsanitized token replacement and improper URI handling.

The Responsive Favicons module does not filter administrator-entered text.

The SAML SSO - Service Provider module doesn't sufficiently sanitize user input.

The Simple hierarchical select module contained a Cross-Site Scripting (XSS) vulnerability in its field formatter and term retrieval functions, allowing malicious users to inject JavaScript code through unsanitized term names.