Drupal CAS Server CVE-2026-87937

Exploitation targets the Central Authentication System (CAS) Server Drupal module running an affected version (<2.0.4 on the 0.x-2.0.x branch, or 2.1.0-2.1.2 on the 2.1.x branch). The core limiting factor is that an open redirect must be triggered through a victim: the attacker needs the target user to follow an attacker-supplied CAS URL, so successful abuse depends on social engineering despite the input vector's UI:N. The specific feature, redirect parameter, or configuration that carries the untrusted target is not detailed in the available sources. The only confirmed complete remediation is updating to a fixed version (2.0.4 or 2.1.3).

This is a moderate-severity open redirect (CWE-601) in the Drupal contrib 'Central Authentication System (CAS) Server' module, scored 6.5 by the reporter with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The signals are internally consistent toward a non-urgent priority: EPSS is very low at 0.18% (7th percentile), the vulnerability is NOT in CISA KEV, and no exploit code or PoC reference is provided - only the vendor advisory (SA-contrib-2026-135) and an NVD mirror. The vuln.today decision label is 'this_month', which matches a patchable, low-probability issue rather than an emergency. One tension worth flagging: the input vector lists UI:N (no user interaction), yet open redirects by nature require a victim to follow a crafted link, so the practical attack depends on social engineering - the real-world risk is lower than a true no-interaction network flaw. The C:L/I:L rating reflects the typical open-redirect consequence (credential/phishing facilitation and source spoofing, 'Fake the Source of Data') rather than direct system compromise. Net: a real but routine patch-this-cycle item, not a high-urgency incident.

An attacker crafts a URL pointing at a vulnerable CAS Server endpoint that embeds an attacker-controlled redirect target, then delivers it via phishing email or a malicious link. A user who trusts the Drupal/CAS domain clicks it, is silently redirected to an attacker-controlled site, and is more easily tricked into entering credentials or trusting forged content. No public exploit code or PoC was identified in the provided sources; the exact trigger parameter is not described in the available advisory data.