CVE-2026-73476

The Drupal External Authentication module, versions 0.0.0 through 2.0.13 , is vulnerable to Privilege Escalation due to improper handling of case sensitivity. The root cause is the module's failure to ensure exact matching of externally supplied identity values when storing and retrieving authent...

CVE-2026-73476 External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...

CVE-2026-73476 External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...

EUVD-2026-69990

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...

CVE-2026-73476 External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...

SUSE CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73476: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the xDS RBAC HTTP filter, which unconditionally lowercases incoming metadata keys so a header matcher configured with uppercase letters, such as X-Role, never matches. An attacker can reach traff...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the xDS RBAC HTTP filter, which unconditionally lowercases incoming metadata keys so a header matcher configured with uppercase letters, such as X-Role, never matches. An attacker can reach traff...

CVE-2026-84303

CVE-2026-84303 affects gRPC-Go (the Go implementation of gRPC). The xDS RBAC HTTP filter (internal/xds/httpfilter/rbac/rbac.go) fails to lowercase header matcher names in normalizeHeaderMatcher, while incoming metadata keys are already lowercase. A DENY policy using a mixed-case name (e.g., X-Rol...

CVE-2026-84303 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as...

Improper Handling of Case Sensitivity

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Improper Handlin...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

AZL-98484 CVE-2026-73270 affecting package erlang for versions less than 26.2.5.21-6

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

DEBIAN-CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

UBUNTU-CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...