The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
| Software | From | Fixed in |
|---|---|---|
| drupal / drupal | 6.0 | 6.0.x |
| drupal / drupal | 6.0-beta1 | 6.0-beta1.x |
| drupal / drupal | 6.0-beta2 | 6.0-beta2.x |
| drupal / drupal | 6.0-beta3 | 6.0-beta3.x |
| drupal / drupal | 6.0-beta4 | 6.0-beta4.x |
| drupal / drupal | 6.0-dev | 6.0-dev.x |
| drupal / drupal | 6.0-rc1 | 6.0-rc1.x |
| drupal / drupal | 6.0-rc2 | 6.0-rc2.x |
| drupal / drupal | 6.0-rc3 | 6.0-rc3.x |
| drupal / drupal | 6.0-rc4 | 6.0-rc4.x |
| drupal / drupal | 6.1 | 6.1.x |
| drupal / drupal | 6.10 | 6.10.x |
| drupal / drupal | 6.11 | 6.11.x |
| drupal / drupal | 6.12 | 6.12.x |
| drupal / drupal | 6.13 | 6.13.x |
| drupal / drupal | 6.14 | 6.14.x |
| drupal / drupal | 6.15 | 6.15.x |
| drupal / drupal | 6.16 | 6.16.x |
| drupal / drupal | 6.17 | 6.17.x |
| drupal / drupal | 6.2 | 6.2.x |
| drupal / drupal | 6.3 | 6.3.x |
| drupal / drupal | 6.4 | 6.4.x |
| drupal / drupal | 6.5 | 6.5.x |
| drupal / drupal | 6.6 | 6.6.x |
| drupal / drupal | 6.7 | 6.7.x |
| drupal / drupal | 6.8 | 6.8.x |
| drupal / drupal | 6.9 | 6.9.x |
| peter_wolanin / openid | 5.x-1.0 | 5.x-1.0.x |
| peter_wolanin / openid | 5.x-1.1 | 5.x-1.1.x |
| peter_wolanin / openid | 5.x-1.2 | 5.x-1.2.x |
| peter_wolanin / openid | 5.x-1.3 | 5.x-1.3.x |
| peter_wolanin / openid | 5.x-1.x-dev | 5.x-1.x-dev.x |