---
id: "CVE-2026-87937"
kind: "vulnerability"
aliases: ["CVE-2026-87937"]
title: "Drupal CAS Server: open redirect lets attackers send users to untrusted sites"
severity: "medium"
cvss: 6.5
epss: 0.00232
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cas-server", "drupal", "package", "self-hosted", "single-sign-on"]
not_affected_if: ["cas-client-only", "no-cas-server-module"]
published_at: "2026-10-22T02:17:03+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:48:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87937", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87937", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal CAS Server: open redirect lets attackers send users to untrusted sites

The Drupal Central Authentication System (CAS) Server module redirects users to URLs an attacker can choose, so a login flow can be used to send victims to a malicious site. An attacker can use the trusted domain to make a phishing or token-theft link look legitimate.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CAS Server module version with `drush pm:list --filter=cas_server` or the Drupal extend page.
- Confirm whether the site runs CAS Server 2.0.4 or earlier, or 2.1.0 through 2.1.3.

## Fix

- Upgrade the Drupal CAS Server module to a version newer than `2.1.3` and newer than `2.0.4`; the sources do not name the exact fixed release, so check the Drupal.org project page.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87937
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87937

## From the sources

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_