CVE-2026-87937

Overview

Drupal Central Authentication System (CAS) Server has an open redirect vulnerability that allows attackers to redirect users to malicious sites. The flaw exists in versions 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. It can be exploited without authentication, potentially compromising user trust and session integrity.

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

Impact

The vulnerability can lead to phishing attacks by redirecting authenticated users to malicious sites, undermining confidentiality of user credentials. Availability is not directly affected, but the integrity of the authentication flow is compromised. Defenders should monitor for anomalous redirect URLs and enforce strict redirect validation. Users may be misled into providing sensitive information.

Remediation

Upgrade to the latest Drupal CAS Server release (≥2.1.4) where the redirect logic has been hardened. If upgrading is not immediately possible, configure the web application firewall to block or whitelist allowed redirect domains, and disable any open redirect parameters in the CAS configuration. Additionally, implement strict referer checks and enforce HTTPS-only redirects.

Risk context

Medium severity (CVSS 6.1) with no EPSS data; the issue is exploitable without authentication, so defenders should treat it as a moderate risk that could facilitate phishing or credential theft.

Affected products

• Drupal CAS 0.0.0-2.0.4
• Drupal CAS 2.1.0-2.1.3