CVE-2026-73476Medium· 5.4▾ SunlitImproper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
external_authentication < 2.0.13external_authentication >= 8.x-1.0, <= 8.x-1.4Upgrade past the affected range:
external_authentication 2.0.13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'
CVE-2026-77560High· 8.1Tinyauth is an authentication and authorization server
CVE-2026-77281Medium· 6.5Caddy is an extensible server platform that uses TLS by default
CVE-2026-90982Medium· 5.3@fastify/static is a Fastify plugin that serves static files from a configured root directory
CVE-2026-27896High· 7.0MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
CVE-2026-57441High· 8.4MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault