DRUPAL-CONTRIB-2026-115

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ldap_auth/DRUPAL-CONTRIB-2026-115.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-115

Aliases

CVE-2026-81205

Published

2026-08-26T17:43:05Z

Modified

2026-08-26T22:30:03.803424008Z

Summary

[none]

Details

This module enables users to authenticate using LDAP or Active Directory credentials.

The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to.

References

https://www.drupal.org/sa-contrib-2026-115

Credits

- Marcus Johansson (marcus_johansson)
- - https://www.drupal.org/u/marcus_johansson

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/ldap_auth

Package

Name: drupal/ldap_auth
Purl: pkg:composer/drupal/ldap_auth?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2.2.1

Database specific

Show details

{
    "constraint": "<2.2.1"
}

Database specific

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ldap_auth/DRUPAL-CONTRIB-2026-115.json"

affected_versions

"<2.2.1"