CVE-2026-1554: Drupal CAS Server XPath Injection Flaw

CVE-2026-1554 Overview

CVE-2026-1554 is an XML Injection vulnerability, also known as Blind XPath Injection, affecting the Drupal Central Authentication System (CAS) Server module. This vulnerability allows authenticated attackers to escalate their privileges within the system by exploiting improper handling of XML data in authentication flows.

Critical Impact

Authenticated attackers can leverage this XPath Injection vulnerability to escalate privileges and potentially gain unauthorized access to restricted functionality within the CAS authentication infrastructure.

Affected Products

• Drupal Central Authentication System (CAS) Server versions 0.0.0 to before 2.0.3
• Drupal Central Authentication System (CAS) Server versions 2.1.0 to before 2.1.2

Discovery Timeline

• 2026-02-04 - CVE-2026-1554 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1554

Vulnerability Analysis

This vulnerability falls under CWE-91 (XML Injection/Blind XPath Injection), a class of injection flaws that occur when user-supplied input is incorporated into XML queries without proper sanitization. In the context of the Drupal CAS Server module, attackers with low-level authentication can craft malicious XML payloads that manipulate XPath queries used during the authentication and authorization process.

The attack requires network access and low privileges, though it has high complexity due to the need to craft specific injection payloads that successfully manipulate the underlying XPath logic. When exploited, the vulnerability can lead to unauthorized disclosure and modification of sensitive data, enabling privilege escalation within the CAS-protected environment.

Root Cause

The root cause of CVE-2026-1554 lies in insufficient input validation and sanitization of user-controlled data before it is incorporated into XPath expressions. The CAS Server module processes XML-based authentication assertions and tickets without adequately filtering special characters and XPath syntax elements. This allows malicious actors to inject arbitrary XPath queries that alter the intended query logic, bypassing authorization controls.

Attack Vector

The attack is conducted over the network by an authenticated user with low privileges. The attacker crafts specially formatted XML input containing XPath injection payloads targeting the authentication or authorization components of the CAS Server. Since this is a "blind" XPath injection, the attacker cannot directly observe query results but can infer success through application behavior changes, such as gaining access to restricted resources or elevated functionality.

The vulnerability is exploited through manipulating XML data submitted during CAS protocol interactions, where XPath expressions are used to parse and validate authentication responses or user attributes.

Detection Methods for CVE-2026-1554

Indicators of Compromise

• Unusual XPath syntax characters in CAS authentication request parameters (e.g., ', ], [, or, and)
• Abnormal user privilege changes without corresponding administrative actions
• Unexpected access patterns to restricted resources by low-privilege accounts

Detection Strategies

• Implement web application firewall (WAF) rules to detect XPath injection patterns in XML payloads
• Monitor CAS Server logs for malformed XML requests or parsing errors
• Audit user privilege changes and compare against authorized administrative actions
• Review authentication assertion processing for anomalous behavior

Monitoring Recommendations

• Enable verbose logging on the Drupal CAS Server module to capture detailed authentication flow data
• Set up alerts for privilege escalation events or unauthorized role assignments
• Monitor for repeated authentication attempts with varying XML payloads from the same source

How to Mitigate CVE-2026-1554

Immediate Actions Required

• Upgrade Drupal CAS Server module to version 2.0.3 or later (for 0.x-2.0.x installations)
• Upgrade to version 2.1.2 or later (for 2.1.x installations)
• Review recent user privilege changes for unauthorized escalations
• Audit CAS Server logs for potential exploitation attempts

Patch Information

Security patches addressing this vulnerability are available from the Drupal project. Refer to the Drupal Security Advisory for detailed patch instructions and release notes. Organizations should prioritize updating to the fixed versions: 2.0.3 or later for the 2.0.x branch, and 2.1.2 or later for the 2.1.x branch.

Workarounds

• Implement strict input validation on all XML data processed by the CAS Server
• Deploy a web application firewall with XPath injection detection rules as a defense-in-depth measure
• Limit network access to the CAS Server to trusted IP ranges where feasible
• Consider temporarily disabling custom XML attribute processing if not essential to operations

# Configuration example - Review Drupal module versions
drush pm-list --type=module | grep cas
# Update CAS Server module to patched version
drush pm-update cas_server