CVE-2026-1554: Drupal CAS Server XPath Injection Flaw

CVE-2026-1554 Overview

CVE-2026-1554 is an XML Injection vulnerability, also known as Blind XPath Injection, affecting the Drupal Central Authentication System (CAS) Server module. This vulnerability allows authenticated attackers to escalate their privileges within the system by exploiting improper handling of XML data in authentication flows.

Critical Impact
Authenticated attackers can leverage this XPath Injection vulnerability to escalate privileges and potentially gain unauthorized access to restricted functionality within the CAS authentication infrastructure.

Affected Products

Drupal Central Authentication System (CAS) Server versions 0.0.0 to before 2.0.3
Drupal Central Authentication System (CAS) Server versions 2.1.0 to before 2.1.2

Discovery Timeline

2026-02-04 - CVE-2026-1554 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1554

Vulnerability Analysis

This vulnerability falls under CWE-91 (XML Injection/Blind XPath Injection), a class of injection flaws that occur when user-supplied input is incorporated into XML queries without proper sanitization. In the context of the Drupal CAS Server module, attackers with low-level authentication can craft malicious XML payloads that manipulate XPath queries used during the authentication and authorization process.

The attack requires network access and low privileges, though it has high complexity due to the need to craft specific injection payloads that successfully manipulate the underlying XPath logic. When exploited, the vulnerability can lead to unauthorized disclosure and modification of sensitive data, enabling privilege escalation within the CAS-protected environment.

Root Cause

The root cause of CVE-2026-1554 lies in insufficient input validation and sanitization of user-controlled data before it is incorporated into XPath expressions. The CAS Server module processes XML-based authentication assertions and tickets without adequately filtering special characters and XPath syntax elements. This allows malicious actors to inject arbitrary XPath queries that alter the intended query logic, bypassing authorization controls.

Attack Vector

The attack is conducted over the network by an authenticated user with low privileges. The attacker crafts specially formatted XML input containing XPath injection payloads targeting the authentication or authorization components of the CAS Server. Since this is a "blind" XPath injection, the attacker cannot directly observe query results but can infer success through application behavior changes, such as gaining access to restricted resources or elevated functionality.

The vulnerability is exploited through manipulating XML data submitted during CAS protocol interactions, where XPath expressions are used to parse and validate authentication responses or user attributes.

Detection Methods for CVE-2026-1554

Indicators of Compromise

Unusual XPath syntax characters in CAS authentication request parameters (e.g., ', ], [, or, and)
Abnormal user privilege changes without corresponding administrative actions
Unexpected access patterns to restricted resources by low-privilege accounts

Detection Strategies

Implement web application firewall (WAF) rules to detect XPath injection patterns in XML payloads
Monitor CAS Server logs for malformed XML requests or parsing errors
Audit user privilege changes and compare against authorized administrative actions
Review authentication assertion processing for anomalous behavior

Monitoring Recommendations

Enable verbose logging on the Drupal CAS Server module to capture detailed authentication flow data
Set up alerts for privilege escalation events or unauthorized role assignments
Monitor for repeated authentication attempts with varying XML payloads from the same source

How to Mitigate CVE-2026-1554

Immediate Actions Required

Upgrade Drupal CAS Server module to version 2.0.3 or later (for 0.x-2.0.x installations)
Upgrade to version 2.1.2 or later (for 2.1.x installations)
Review recent user privilege changes for unauthorized escalations
Audit CAS Server logs for potential exploitation attempts

Patch Information

Security patches addressing this vulnerability are available from the Drupal project. Refer to the Drupal Security Advisory for detailed patch instructions and release notes. Organizations should prioritize updating to the fixed versions: 2.0.3 or later for the 2.0.x branch, and 2.1.2 or later for the 2.1.x branch.

Workarounds

Implement strict input validation on all XML data processed by the CAS Server
Deploy a web application firewall with XPath injection detection rules as a defense-in-depth measure
Limit network access to the CAS Server to trusted IP ranges where feasible
Consider temporarily disabling custom XML attribute processing if not essential to operations

bash

# Configuration example - Review Drupal module versions
drush pm-list --type=module | grep cas
# Update CAS Server module to patched version
drush pm-update cas_server