CVE-2026-1554

The Drupal Central Authentication System (CAS) Server module is vulnerable to XML Injection (also known as Blind XPath Injection ) due to insufficient sanitization of user-supplied field values configured as attributes in a CAS server response. This flaw allows for Privilege Escalation . The vuln...