PT-2026-89237

CVE-2026-87937

Published

2026-09-09

Updated

2026-10-22

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Central Authentication System (CAS) Server versions 0.0.0 through 2.0.4 Drupal Central Authentication System (CAS) Server versions 2.1.0 through 2.1.3

Description An open redirect issue exists because the module does not sufficiently validate the service URL used to redirect users during the logout process. This allows an attacker to fake the source of data by redirecting users to an untrusted site, provided the user clicks a specially crafted link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors