[ CVE-2026-87937 · Published 22 Oct 2026 ]
Vulnerability in Drupal Central Authentication System (CAS) Server
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.