CVE-2026-87937

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Central Authentication System CAS Server allows Fake the Source of Data. This issue affects Central Authentication System CAS Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3...

CVE-2026-87937 Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Central Authentication System CAS Server allows Fake the Source of Data. This issue affects Central Authentication System CAS Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3...

CVE-2026-87937

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Central Authentication System CAS Server allows Fake the Source of Data. This issue affects Central Authentication System CAS Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3...

CVE-2026-87937

The Drupal Central Authentication System (CAS) Server module (versions 0.0.0 to 2.0.4 and 2.1.0 to 2.1.3 ) is vulnerable to an Open Redirect (CWE-601). The root cause is insufficient validation of the service URL used to redirect users during the logout process , allowing an attacker to redirect ...

CVE-2026-87937 Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Central Authentication System CAS Server allows Fake the Source of Data. This issue affects Central Authentication System CAS Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3...

EUVD-2026-107864

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Central Authentication System CAS Server allows Fake the Source of Data. This issue affects Central Authentication System CAS Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3...

CVE-2026-87937 Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Central Authentication System CAS Server allows Fake the Source of Data. This issue affects Central Authentication System CAS Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3...

Drupal Central Authentication System Server input validation error vulnerability

The Drupal Central Authentication System Server versions prior to 0.0.0 and 2.0.4, as well as versions prior to 2.1.0 and 2.1.3, contain an input validation error vulnerability. This vulnerability stems from URL redirection to untrusted sites open redirect, potentially leading to forged data...

CVE-2026-1554

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

CVE-2026-1554

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

CVE-2026-1554

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

CVE-2026-1554

The Drupal Central Authentication System (CAS) Server module is vulnerable to XML Injection (also known as Blind XPath Injection ) due to insufficient sanitization of user-supplied field values configured as attributes in a CAS server response. This flaw allows for Privilege Escalation . The vuln...

CVE-2026-1554 Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

EUVD-2026-5352

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

CVE-2026-1554: XML Injection (aka Blind XPath Injection)

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

Drupal Central Authentication System Server security vulnerability

The Drupal Central Authentication System Server is a CAS authentication center module developed by the Drupal company. Versions prior to 2.0.3 and 2.1.2 of the Drupal Central Authentication System Server had security vulnerabilities. These vulnerabilities were caused by XML injection, which could...

DRUPAL-CONTRIB-2026-007

This module enables you to turn a Drupal install into the Central Authentication System CAS. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently sanitize user-supplied field values configured to be included ...

Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

This module enables you to turn a Drupal install into the Central Authentication System CAS. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently sanitize user-supplied field values configured to be included ...

PT-2026-5243

Name of the Vulnerable Software and Affected Versions Drupal Central Authentication System CAS Server versions prior to 2.0.3 Drupal Central Authentication System CAS Server versions 2.1.0 through 2.1.1 Description The Central Authentication System CAS Server module for Drupal does not adequately...