{"id":"CVE-2026-87937","kind":"vulnerability","aliases":["CVE-2026-87937"],"related":[],"title":"Drupal CAS Server: open redirect lets attackers send users to untrusted sites","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.","summary":"The Drupal Central Authentication System (CAS) Server module redirects users to URLs an attacker can choose, so a login flow can be used to send victims to a malicious site. An attacker can use the trusted domain to make a phishing or token-theft link look legitimate.","severity":"medium","cvss":6.5,"epss":0.00232,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cas-server","drupal","package","self-hosted","single-sign-on"],"not_affected_if":["cas-client-only","no-cas-server-module"],"how_to_check":"- Check the installed CAS Server module version with `drush pm:list --filter=cas_server` or the Drupal extend page.\n- Confirm whether the site runs CAS Server 2.0.4 or earlier, or 2.1.0 through 2.1.3.","fix":"- Upgrade the Drupal CAS Server module to a version newer than `2.1.3` and newer than `2.0.4`; the sources do not name the exact fixed release, so check the Drupal.org project page.","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:42+00:00","updated_at":"2026-10-25T03:48:42+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal CAS Server module to a version newer than `2.1.3` and newer than `2.0.4`; the sources do not name the exact fixed release, so check the Drupal.org project page.","reach":"internet","title":"Drupal CAS Server: open redirect lets attackers send users to untrusted sites","impact":"low","summary":"The Drupal Central Authentication System (CAS) Server module redirects users to URLs an attacker can choose, so a login flow can be used to send victims to a malicious site. An attacker can use the trusted domain to make a phishing or token-theft link look legitimate.","category":"package","nicknames":[],"who_cares":["drupal","cas-server","single-sign-on","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Users get redirected to attacker-chosen sites from a trusted login page","analyst_note":"Confirm the exact fixed version and whether a login is needed, from the NVD entry and the Drupal.org security advisory for the CAS Server module.","how_to_check":"- Check the installed CAS Server module version with `drush pm:list --filter=cas_server` or the Drupal extend page.\n- Confirm whether the site runs CAS Server 2.0.4 or earlier, or 2.1.0 through 2.1.3.","needs_analyst":true,"not_affected_if":["no-cas-server-module","cas-client-only"],"who_is_affected":"Sites that run the Drupal CAS Server module to act as a single sign-on provider for other applications are affected. Sites that only use CAS as a client, or that do not run the CAS Server module at all, are not exposed to this issue.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3379,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87937':15A,18A '0.0.0':109C '2.0.4':111C '2.1.0':113C '2.1.3':115C 'affect':101C 'allow':93C 'attack':7A,43B,61B 'authent':33B,89C,103C 'cas':2A,20B,35B,91C,105C 'cas-serv':19B 'central':32B,88C,102C 'choos':45B 'cve':13A,16A 'data':98C 'domain':66B 'drupal':1A,22B,31B,87C 'fake':94C 'flow':49B 'host':26B 'issu':100C 'legitim':77B 'let':6A 'link':75B 'login':48B 'look':76B 'make':68B 'malici':58B 'modul':37B 'open':4A,83C 'packag':23B 'phish':70B 'redirect':5A,38B,79C,84C 'self':25B 'self-host':24B 'send':8A,54B 'server':3A,21B,36B,92C,106C 'sign':29B 'singl':28B 'single-sign-on':27B 'site':12A,59B,82C 'sourc':96C 'system':34B,90C,104C 'theft':74B 'token':73B 'token-theft':72B 'trust':65B 'untrust':11A,81C 'url':41B,78C 'use':52B,63B 'user':9A,39B 'version':107C 'victim':55B 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Sites that run the Drupal CAS Server module to act as a single sign-on provider for other applications are affected. Sites that only use CAS as a client, or that do not run the CAS Server module at all, are not exposed to this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87937","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87937","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87937","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}