CVE-2026-87937 in Central Authentication System Server
Summary
by MITRE • 10/22/2026
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as an Open Redirect within the Drupal Central Authentication System module represents a significant security flaw that undermines the integrity of authentication flows and user trust. This issue specifically affects versions ranging from 0.0.0 up through 2.0.4, as well as subsequent releases from 2.1.0 to 2.1.3. The core technical deficiency lies in how the CAS server component handles redirect parameters provided by users or external services during the authentication process. When a user initiates an login sequence that requires redirection back to a specific destination after successful verification, the application fails to adequately validate whether this target URL belongs to a trusted domain. Consequently, attackers can manipulate these redirect parameters to point towards malicious third-party websites rather than legitimate internal resources.
From a technical perspective, this flaw is classified under CWE-601, which defines Open Redirect vulnerabilities where an attacker redirects users from the application to external sites without proper validation. The mechanism typically involves injecting crafted URLs into query strings or form fields that are subsequently passed directly to HTTP redirect functions such as header Location directives in PHP-based environments like Drupal. Because the CAS module does not implement strict allow-listing mechanisms for destination hosts, it blindly executes the redirection instruction provided by the input source. This lack of sanitization allows malicious actors to construct phishing links that appear to originate from the legitimate Drupal site but ultimately lead victims to fraudulent pages designed to harvest credentials or distribute malware.
The operational impact of this vulnerability extends beyond simple misdirection and poses a severe risk to organizational security posture through social engineering attacks. Attackers can exploit this flaw by sending deceptive emails containing links that mimic the official CAS login page, thereby increasing the likelihood of success in phishing campaigns. Since the initial part of the URL displays the trusted domain name before redirecting away from it, users may lower their guard and enter sensitive information on a counterfeit site controlled by the attacker. This capability effectively allows an adversary to fake the source of data, eroding user confidence in the authentication infrastructure and potentially leading to unauthorized access if credentials are compromised through these deceptive redirects.
In alignment with industry frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1566.002, which covers Spearphishing Links where attackers send links designed to trick users into visiting malicious sites. The exploitation of this flaw facilitates the initial access phase of an attack chain by leveraging human psychology rather than technical exploits against software logic alone. To mitigate this risk, organizations must immediately upgrade the Central Authentication System module to a version newer than 2.1.3 where these validation checks have been implemented. Additionally, developers should enforce strict allow-listing for redirect destinations, ensuring that only predefined trusted domains are permitted as final endpoints after authentication. Implementing Content Security Policy headers with appropriate frame-ancestors and script-src directives can also provide an additional layer of defense against clickjacking and redirection-based attacks in broader web application contexts.