The OpenID module was not a compliant implementation of the OpenID Authentication 2.0 specification. An implementation error allowed a user to access the account of another user when they share the same OpenID 2.0 provider.
Part of security release SA-CORE-2009-008
This vulnerability affects the following application versions:
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8
- Drupal 6.9
- Drupal 6.10
- Drupal 6.11
- Drupal 6.12
- Drupal 6.13