CVE-2012-2727: Open redirect vulnerability in the Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when synchronizin...

Security readout for executives and security teams

This CVE describes a phishing-enabling flaw in the Janrain Capture module for Drupal. A crafted destination parameter could send users from a legitimate Drupal workflow to an attacker-controlled website. The source bundle does not provide CVSS, patch details, or evidence of active exploitation. Exposure is limited to Drupal sites using the Janrain Capture contributed module at versions 6.x-1.0 or 7.x-1.0, especially where user synchronization flows are reachable by users. Treat this as a targeted phishing risk, not a server-compromise issue based on available evidence. Prioritize validation on externally accessible Drupal sites using Janrain Capture, then follow Drupal or maintainer guidance. Mitigation focus: Check Drupal and module maintainer advisories for corrected versions or official mitigation guidance.; Inventory and prioritize sites running Janrain Capture 6.x-1.0 or 7.x-1.0.; Disable or remove the module where it is not business-critical..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.