CVE-2015-4395: The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when th...

Security readout for executives and security teams

A Drupal 7 site using HybridAuth Social Login could have stored user passwords in plaintext when a specific registration option was enabled. If an authenticated user with the right permissions could access the database, those passwords could be exposed. This is mainly a credential confidentiality issue, not a remote takeover by itself. Exposure is limited to Drupal 7 deployments using the HybridAuth Social Login contributed module 7.x-2.x before 7.x-2.10 with the affected password-registration option enabled. Systems not using this module, not on the affected branch, or not using that option are not indicated as affected by the source bundle. Prioritize remediation for any internet-facing Drupal 7 site using this module because plaintext password exposure can create downstream account compromise, especially where users reuse passwords. Urgency is moderate unless evidence shows exposed database access or affected plaintext records. Mitigation focus: Upgrade HybridAuth Social Login to 7.x-2.10 or later if still deployed.; Disable the affected password prompt option until vendor guidance is applied.; Restrict database access to administrators and required service accounts only..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.