Drupal Internationalization SSO CVE-2026-16639

The target must have the Drupal Internationalization Single Sign-On contrib module installed and enabled at a vulnerable version (0.0.0 through 1.8.0); the flaw lies in an alternate authentication path/channel exposed by this module, so a deployment not running it is unaffected. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client-side conditions are required - exploitation is remote and network-based against affected installs. The primary limiting factor is deployment scope: only Drupal sites that have specifically added this module are at risk; the exact triggering endpoint and any language-configuration prerequisites are not detailed in the available data and should be confirmed against SA-CONTRIB-2026-081.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated bypass with high impact on all three security properties, which is the classic 9.8 'critical' profile and warrants prompt patching wherever the module is installed. Counterbalancing signals, however, temper the urgency: EPSS is only 0.18% (8th percentile), there is no KEV listing and no public exploit identified, and the affected artifact is a niche Drupal contrib module rather than ubiquitous software, so realistic exposure is limited to the subset of Drupal sites running this specific module. The severity ceiling is real for affected sites, but the low EPSS and narrow deployment footprint suggest this is a high-priority patch for the few affected operators rather than a broad, imminently-exploited threat.

A remote, unauthenticated attacker requests the module's alternate SSO login path or callback directly, submitting a crafted request that the secondary channel accepts without completing full authentication, and is granted an authenticated Drupal session. With that session the attacker reads restricted content, modifies data, or escalates within the site consistent with the account context obtained. No public exploit code has been identified at time of analysis, and given AC:L/PR:N/UI:N the technique would be straightforward once the endpoint behavior is understood.