CVE-2026-87937

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87937
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87937.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87937
Aliases
Published
2026-10-22T01:22:04Z
Modified
2026-10-28T02:30:38Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
Details

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

Database specific 
{
    "cna_assigner": "drupal",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87937.json"
}
References

Affected packages

Git / git.drupalcode.org/project/cas_server

Affected ranges

Type
GIT
Repo
https://git.drupalcode.org/project/cas_server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b55cd99d5aaeacc063533ecb9f06d298cf13af47
Introduced
b84717c5fa472b63e5fc5c54424687e9bac0f8ef
Fixed
0122a4885518a0d637ba4197cc5c064b27e11f7c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.0.0"
                },
                {
                    "fixed": "2.0.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.1.0"
                },
                {
                    "fixed": "2.1.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.0-rc1
2.0.0-rc2
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
8.*
8.x-1.0
8.x-1.0-beta1
8.x-1.0-beta2
8.x-1.0-beta3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87937.json"