🔐 CVE Alert

CVE-2026-87937

UNKNOWN 0.0

Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

CWE CWE-601
Vendor drupal
Product central authentication system (cas) server
Ecosystems
Industries
WebMedia
Published Oct 22, 2026
Stay Ahead of the Next One

Get instant alerts for drupal central authentication system (cas) server

Be the first to know when new unknown vulnerabilities affecting drupal central authentication system (cas) server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / Central Authentication System (CAS) Server
0.0.0 < 2.0.4 2.1.0 < 2.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-135

Credits

Kalle Kipinä (kekkis) Ted Cooper (elc) Bram Driesen (bramdriesen) Greg Knaddison (greggles) Jess (xjm) Swan Kalata (akalata)