drupal Central Authentication System (CAS) Server vulnerabilities

Latest drupal Central Authentication System (CAS) Server CVEs

Newest publication first

1. CVE-2026-87937 Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

   Published 2026-10-22

   Medium·CVSS 6.5 EPSS 0.28%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

2. CVE-2026-1554 Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

   Published 2026-02-04

   Medium·CVSS 4.2 EPSS 0.17%

   XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.