Live › vulnerability › CVE-2026-87937
Go to dashboardThe Drupal Central Authentication System (CAS) Server module redirects users to URLs an attacker can choose, so a login flow can be used to send victims to a malicious site. An attacker can use the trusted domain to make a phishing or token-theft link look legitimate.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that run the Drupal CAS Server module to act as a single sign-on provider for other applications are affected. Sites that only use CAS as a client, or that do not run the CAS Server module at all, are not exposed to this issue.
No product ranges from the sources yet.
drush pm:list --filter=cas_server or the Drupal extend page.2.1.3 and newer than 2.0.4; the sources do not name the exact fixed release, so check the Drupal.org project page.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-87937")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.