Drupal External Authentication CVE-2026-73476

The target Drupal site must have the External Authentication contributed module installed, enabled, and configured to delegate authentication to an external provider (LDAP, SAML, SSO, or similar). The attacker must possess low-level credentials sufficient to authenticate via that external provider (PR:L) and must be able to control or manipulate the username or identity attribute presented during authentication - for example, by registering an account at the provider level with a case-variant name. Sites using only Drupal core local authentication are entirely unaffected. Exploitation impact is highest when external accounts can be mapped to privileged Drupal roles; installations where external users are restricted to low-privilege roles experience reduced real-world impact.

The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a network-exploitable, low-complexity flaw requiring only low-level privileges, but with bounded impact metrics (C:L/I:L) suggesting partial rather than full compromise in the general case. However, the 'Privilege Escalation' classification is significant: in Drupal deployments where external identities are mapped to administrator or editor roles, real-world impact could substantially exceed the base score. EPSS data is absent from the provided intelligence, so automated exploitation likelihood cannot be quantified independently. No KEV listing exists and no public exploit code has been identified. Even a mid-sized municipal IT team in kielce running Drupal with SSO or LDAP integration should evaluate whether privileged roles are reachable via externally-authenticated accounts before concluding the raw score is representative. Overall this is a genuine, moderate-priority issue - not a critical emergency, but worth prompt remediation for any site with external auth and privileged role assignments.

An attacker with access to a configured external authentication provider (such as LDAP or an SSO identity store) submits credentials using a username that differs only in case from a privileged Drupal account - for example presenting 'Admin' when the privileged local account is 'admin'. The External Authentication module, lacking case normalization, resolves the presented identity to the privileged Drupal account and grants the attacker that account's role and permissions. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) suggests straightforward exploitation once a target privileged account name is identified.