CVE-2026-16639

Name of the Vulnerable Software and Affected Versions Drupal Internationalization Single Sign-On versions 0.0.0 through 1.8.0

Description An authentication bypass exists in the Drupal Internationalization Single Sign-On module. The module fails to sufficiently validate a short-lived token, which allows an attacker to bypass access control and authenticate as a victim user. This issue occurs in multilingual website scenarios where different domain names are used per language to enable automatic connection across domains. Exploitation requires the attacker to appear to originate from the same client IP address as the victim.

Recommendations Update Drupal Internationalization Single Sign-On to a version later than 1.8.0.