CVE-2026-87937: Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

Q: Which versions need remediation?

Affected versions are 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. Versions outside those ranges are not identified as affected by the provided advisory data.

Q: What is the impact of successful exploitation?

The issue is an open redirect that can redirect users to an untrusted site, allowing an attacker to fake the source of data.

Published Oct 22, 2026

Updated

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

Affected Software

1 affected component

Drupal Central Authentication System (CAS) Server>=0.0.0<=2.0.4, >=2.1.0<=2.1.3

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which versions need remediation?

Affected versions are 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. Versions outside those ranges are not identified as affected by the provided advisory data.

What is the impact of successful exploitation?

The issue is an open redirect that can redirect users to an untrusted site, allowing an attacker to fake the source of data.

CVE-2026-87937: Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

Affected Software

Event History

Frequently Asked Questions

Which versions need remediation?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which versions need remediation?

What is the impact of successful exploitation?