CVE-2026-1554

4.2 mediumEPSS 0.2%

Medium (4.2) in jtenman central authentication system server. EPSS 0.2% chance of exploitation in the next 30 days.

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

Severity

CVSS 3.1

4.2 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE: CWE-91
Published: 2026-02-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jtenman:central_authentication_system_server

References

https://www.drupal.org/sa-contrib-2026-007

Check your stack JSON