All vulnerabilities
CVE-2026-87937

Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

Drupal Central Authentication System (CAS) ServerApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.4Also 2.1.3CVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 2.0.4Central Authentication System (CAS) ServerCVE List
  • 2.1.3Central Authentication System (CAS) ServerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

Text from CVE List

Affected versions 2

  • Central Authentication System (CAS) Serveraffected: 0.0.0 before 2.0.4CVE List
  • Central Authentication System (CAS) Serveraffected: 2.1.0 before 2.1.3CVE List

References 1