EUVD-2026-66181
GHSA-p748-p4j4-gpx6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Alternate-channel auth bypass is remotely reachable with no auth, no interaction, and low complexity (PR:N/UI:N/AC:L); a full session takeover yields high C/I/A.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
AnalysisAI
Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must have the Drupal Internationalization Single Sign-On contrib module installed and enabled at a vulnerable version (0.0.0 through 1.8.0); the flaw lies in an alternate authentication path/channel exposed by this module, so a deployment not running it is unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated bypass with high impact on all three security properties, which is the classic 9.8 'critical' profile and warrants prompt patching wherever the module is installed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Internationalization Single Sign-On module to the fixed release referenced in Drupal advisory SA-CONTRIB-2026-081 (https://www.drupal.org/sa-contrib-2026-081); the input confirms a vendor patch is available but does not state an exact fixed version number, so obtain the specific patched release directly from that advisory (the fix supersedes the vulnerable 0.0.0-1.8.0 range). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Drupal installations using the Internationalization Single Sign-On module and confirm which versions (0.0.0 through 1.8.0) are deployed; review vendor advisory SA-CONTRIB-2026-081 for patch availability and prerequisites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today