CVE-2026-87937

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

Score

CVSS 3.1 6.5 Medium

Status

Awaiting Analysis - mlhess@drupal.org

Published

2026-10-22

Last modified

2026-10-22

Weaknesses

CWE-601

Affected products

• Central Authentication System Cas Server (Drupal)

References

• https://www.drupal.org/sa-contrib-2026-135