CVE-2026-87937: Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
Published Oct 22, 2026
·Updated
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
Affected Software
1 affected component
Drupal Central Authentication System (CAS) Server>=0.0.0<=2.0.4, >=2.1.0<=2.1.3
Event History
Oct 22, 2026
CVE Published
via MITRE·01:22 AM
Data Sourced
via MITRE·01:22 AM
DescriptionWeakness
Data Sourced
via NVD·02:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions need remediation?
Affected versions are 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. Versions outside those ranges are not identified as affected by the provided advisory data.
2
What is the impact of successful exploitation?
The issue is an open redirect that can redirect users to an untrusted site, allowing an attacker to fake the source of data.