PT-2026-5243 · Drupal · Central Authentication System (Cas) Server

Gaãl Gosset + 4 · CVE-2026-1554 · Published 2026-01-28 · Updated 2026-02-11

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Central Authentication System (CAS) Server versions prior to 2.0.3 Drupal Central Authentication System (CAS) Server versions 2.1.0 through 2.1.1

Description The Central Authentication System (CAS) Server module for Drupal does not adequately sanitize user-provided field values when configured as attributes in a CAS server response, leading to an XML Element Injection issue. An attacker must be authenticated and have the ability to input XML into a user entity field that is configured as a CAS Attribute source to exploit this.

Recommendations Update Drupal Central Authentication System (CAS) Server to version 2.0.3 or later. Update Drupal Central Authentication System (CAS) Server to version 2.1.2 or later.

Exploit

Fix

LPE

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-1554

DRUPAL-CONTRIB-2026-007

Affected Products

Central Authentication System (Cas) Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1554.json · Exploit
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1554 · Vendor Advisory
• https://drupal.org/sa-contrib-2026-007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1554 · Security Note
• https://t.me/CVEtracker/43764 · Telegram Post
• https://t.me/cveNotify/151005 · Telegram Post
• https://twitter.com/CVEnew/status/2019182770686484963 · Twitter Post
• https://git.drupalcode.org/project/cas_server · Note
• https://twitter.com/MNovofastovsky/status/2020596496442196031 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2021599501404786873 · Twitter Post
• https://drupal.org/project/cas_server · Note