{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-0948","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-0948\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-0948\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3483782","id":"3483782","resource":"node"},"field_sa_advisory_id":"005","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:None\/CI:Some\/II:Some\/E:Theoretical\/TD:All","field_sa_description":{"value":"\u003Cp\u003EThis module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0.\u003C\/p\u003E\n\u003Cp\u003EThe module doesn\u0027t sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target\u0027s email account.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/jaseerkinangattil\u0022 rel=\u0022nofollow\u0022\u003EJaseer Kinangattil (jaseerkinangattil)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/ashishverma85\u0022 rel=\u0022nofollow\u0022\u003EAshish Verma (ashish.verma85)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/dheeraj-jhamtani\u0022 rel=\u0022nofollow\u0022\u003EDheeraj Jhamtani (dheeraj jhamtani)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/marcelovani\u0022 rel=\u0022nofollow\u0022\u003EMarcelo Vani (marcelovani)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Col\u003E\n\u003Cli\u003EIf you use the Microsoft Entra ID SSO Login, update to the module\u0027s latest version \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/social_auth_entra_id\/releases\/2.0.0\u0022 rel=\u0022nofollow\u0022\u003EMicrosoft Entra ID SSO Login 2.0.0\u003C\/a\u003E (or \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/social_auth_entra_id\/releases\/1.0.4\u0022 rel=\u0022nofollow\u0022\u003EMicrosoft Entra ID SSO Login 1.0.4\u003C\/a\u003E).\n\u003C\/li\u003E\n\u003Cli\u003EReview the release notes and module documentation for information on how to update your configuration with the new module release.\u003C\/li\u003E\n\u003Cli\u003ESite administrators should also review their security settings after upgrading and consider enabling the \u0022Block User 1\u0022 and \u0022Block Administrator role\u0022 options for additional protection.\u003C\/li\u003E\n\u003C\/ol\u003E","format":"1"},"field_sa_type":"Access bypass","field_issue_last_status_change":"1768415582","field_sa_cve":["CVE-2026-0948"],"field_is_psa":"0","field_affected_versions":"\u003C1.0.4","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3561451","id":"3561451","resource":"node"}],"nid":"3567531","vid":"14231478","is_new":false,"type":"sa","title":"Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-005","edit_url":"https:\/\/www.drupal.org\/node\/3567531\/edit","status":"1","promote":"0","sticky":"0","created":"1768413451","changed":"1768415582","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16412445","id":16412445,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16412446","id":16412446,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16412447","id":16412447,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16412448","id":16412448,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16412449","id":16412449,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16412451","id":16412451,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1768413451"}]}