CVE-2026-73476 External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
Attackers can bypass authentication via case sensitivity flaws in the Drupal External Authentication module, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73476?
CVE-2026-73476 is a medium-severity authentication bypass vulnerability in Drupal External Authentication, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
Weakness: CWE-178
Which versions are affected by CVE-2026-73476?
It affects 1 product.
Linux distribution packages (1)
drupal/externalauth Packagist:https://packages.drupal.org/8 | All versions | 2.0.13 |
Products include External Authentication Project External Authentication.
How do I fix CVE-2026-73476?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73476 being exploited?
There is no known exploitation of CVE-2026-73476 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-098, GHSA-85hq-q7c6-7j82.