---
id: CVE-2026-87937
title: >-
  Central Authentication System (CAS) Server - Moderately critical - Open
  redirect - SA-CONTRIB-2026-135
summary: >-
  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal
  Central Authentication System (CAS) Server allows Fake the Source of Data.
  This issue affects Central Authentication System (CAS) Server versions: from
  0.0.0 to …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-601
vendor: Drupal
product: Central Authentication System (CAS) Server
affected:
  - central_authentication_system_cas_server >= 0.0.0 < 2.0.4
  - central_authentication_system_cas_server >= 2.1.0 < 2.1.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-22T17:29:51.776152Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T17:29:54.899Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87937'
references:
  - url: 'https://www.drupal.org/sa-contrib-2026-135'
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.194Z'
epss: 0.00284
epssPercentile: 0.2084
---

## Overview

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

## Affected

- `central_authentication_system_cas_server >= 0.0.0 < 2.0.4`
- `central_authentication_system_cas_server >= 2.1.0 < 2.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.