CVE-2026-73476: Drupal External Authentication Privilege Escalation

CVE-2026-73476 Overview

CVE-2026-73476 is a privilege escalation vulnerability in the Drupal External Authentication contributed module. The flaw stems from improper handling of case sensitivity [CWE-178] when processing external authentication identifiers. Attackers with low-privilege network access can leverage username case variations to gain unintended account access or elevated permissions. The vulnerability affects External Authentication versions from 0.0.0 through 2.0.13. Drupal published Security Advisory SA-CONTRIB-2026-098 to address the issue.

Critical Impact
Authenticated attackers can escalate privileges by exploiting case-insensitive matching in external authentication mapping, potentially accessing accounts belonging to other users.

Affected Products

Drupal External Authentication module versions 0.0.0 through 2.0.13
Drupal sites using the External Authentication contributed module for identity federation
Any Drupal deployment relying on external authentication providers mapped through the affected module

Discovery Timeline

2026-09-02 - CVE-2026-73476 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73476

Vulnerability Analysis

The Drupal External Authentication module maps external identity provider usernames to local Drupal accounts. The module fails to consistently enforce case sensitivity when comparing or storing these external authentication identifiers. This inconsistency creates a mismatch between how identifiers are validated and how they resolve to internal accounts.

An authenticated attacker can supply a username that differs only in letter case from a legitimate user's identifier. The authentication layer treats the variant as valid, while the account resolution logic maps it to an existing higher-privileged account. The result is privilege escalation without needing to compromise credentials directly.

The issue is classified under CWE-178: Improper Handling of Case Sensitivity. The attack requires network access and low privileges but no user interaction. Impact is limited to confidentiality and integrity of user account data, with no direct availability impact.

Root Cause

The root cause is inconsistent normalization of external authentication identifiers. The module does not uniformly apply case-folding or case-preserving comparison across all code paths that touch the identifier. Storage, lookup, and validation routines handle case differently, producing exploitable authentication decisions.

Attack Vector

Exploitation requires an attacker to hold a valid low-privilege authenticated session on the target Drupal site. The attacker submits an external authentication identifier crafted with alternate letter casing that matches a targeted higher-privileged account. See the Drupal Security Advisory SA-CONTRIB-2026-098 for module-specific technical details.

No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-73476

Indicators of Compromise

Authentication log entries showing successful logins with usernames that differ only by letter case from established accounts
Multiple authmap table entries in the Drupal database that resolve to the same local user through case-variant identifiers
Unexpected role or permission changes on user accounts following external authentication events

Detection Strategies

Audit the Drupal authmap table for entries where the authname column contains case variations that collide with existing usernames
Review web server and Drupal watchdog logs for authentication requests containing unusual capitalization patterns targeting privileged accounts
Correlate external authentication provider logs with Drupal login events to identify identifier casing discrepancies

Monitoring Recommendations

Enable verbose logging for the External Authentication module and forward events to a centralized log platform for retention and query
Alert on privilege changes and role assignments occurring shortly after external authentication events
Track failed and successful authentication attempts targeting administrative accounts across identity provider and Drupal logs

How to Mitigate CVE-2026-73476

Immediate Actions Required

Upgrade the Drupal External Authentication module to a version later than 2.0.13 as released in Drupal Security Advisory SA-CONTRIB-2026-098
Audit the authmap table and remove or reconcile duplicate entries that differ only in case
Review administrative and elevated-role accounts for unauthorized changes since the module was deployed

Patch Information

Drupal has released a fixed version of the External Authentication module. Consult the Drupal Security Advisory SA-CONTRIB-2026-098 for the specific patched release and upgrade instructions. Apply the update through Composer or the Drupal update workflow used in your environment.

Workarounds

Restrict access to authenticated user registration and external authentication endpoints until the module can be patched
Enforce case-normalized usernames at the identity provider to prevent submission of case-variant identifiers
Temporarily disable the External Authentication module if patching cannot be completed and alternative authentication paths are available

bash

# Upgrade the External Authentication module using Composer
composer update drupal/externalauth --with-dependencies
drush updatedb
drush cache:rebuild