[IT-SecNots] [Security-news] External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-098

Project: External Authentication [1]
Date: 2026-August-12
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: <2.0.13
CVE IDs: CVE-2026-73476
Description: 
This module enables you to authenticate Drupal users against external
identity providers.
The module does not sufficiently ensure exact matching of externally supplied
identity values when storing and looking up authentication mappings under
certain database collation configurations.
This vulnerability is mitigated by the fact that it affects only sites using
impacted MySQL or MariaDB collation settings for the module’s
authentication mapping storage.

Solution: 
Install the latest version:

 * If you use the externalauth module for Drupal, upgrade to 2.0.13 [3]

Reported By: 
 * 晉宇 林 (whale120) [4]

Fixed By: 
 * Sven Decabooter (svendecabooter) [5]

Coordinated By: 
 * Swan Kalata (akalata) [6] of the Drupal Security Team
 * Neil Drumm (drumm) [7] of the Drupal Security Team
 * Greg Knaddison (greggles) [8] of the Drupal Security Team
 * Juraj Nemec (poker10) [9] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [10]

[1] https://www.drupal.org/project/externalauth
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/externalauth/releases/2.0.13
[4] https://www.drupal.org/u/whale120
[5] https://www.drupal.org/u/svendecabooter
[6] https://www.drupal.org/u/akalata
[7] https://www.drupal.org/u/drumm
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3610827

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at