---
id: CVE-2026-87937
title: >-
  Central Authentication System (CAS) Server - Moderately critical - Open
  redirect - SA-CONTRIB-2026-135
summary: >-
  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal
  Central Authentication System (CAS) Server allows Fake the Source of Data.
  This issue affects Central Authentication System (CAS) Server versions: from
  0.0.0 to …
severity: none
cwe:
  - CWE-601
vendor: Drupal
product: Central Authentication System (CAS) Server
affected:
  - central_authentication_system_cas_server >= 0.0.0 < 2.0.4
  - central_authentication_system_cas_server >= 2.1.0 < 2.1.3
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T01:22:04.473Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87937'
references:
  - url: 'https://www.drupal.org/sa-contrib-2026-135'
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.194Z'
---

## Overview

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

## Affected

- `central_authentication_system_cas_server >= 0.0.0 < 2.0.4`
- `central_authentication_system_cas_server >= 2.1.0 < 2.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.