Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T23:16:56.673Z",
  "pubdate": "2026-08-25T23:16:56.673Z",
  "executiveSummary": "The Internationalization Single Sign-On module for Drupal contains an authentication bypass vulnerability categorized as CWE-288: Authentication Bypass Using an Alternate Path or Channel.\nThis security flaw allows an unauthenticated remote attacker to circumvent standard authentication mechanisms, potentially gaining unauthorized access to the application.\nThe vulnerability affects all versions of the Internationalization Single Sign-On module from 0.0.0 through 1.8.0.\nThe risk implication is critical, as successful exploitation results in complete loss of confidentiality and integrity, enabling an attacker to impersonate legitimate users, including those with administrative privileges.\nExploitation does not require prior authentication or specialized credentials, making it a high-priority threat for organizations relying on this SSO integration for identity management.\nThe flaw stems from a logical error in how the module validates authentication requests through alternate paths or communication channels, failing to verify the legitimacy of the asserted identity before establishing a session.",
  "technicalDetails": "The vulnerability resides within the Internationalization Single Sign-On (SSO) module for Drupal, specifically in the logic responsible for handling incoming authentication assertions or session management callbacks.\nThe root cause is an implementation error consistent with CWE-288, where the module provides an alternative path for authentication that lacks the rigorous validation checks applied to the primary authentication flow.\nWhen a user attempts to authenticate via the SSO mechanism, the module fails to properly validate the integrity or the origin of the authentication token or the assertion provided via the alternate channel.\nThe attack flow initiates when an attacker crafts a malicious request that targets the vulnerable alternative path or endpoint used by the Internationalization Single Sign-On module.\nBy manipulating parameters or headers, the attacker bypasses the module's validation logic, effectively deceiving the application into accepting an unverified assertion as a valid, authenticated session.\nBecause the module fails to verify the cryptographically signed response or validate the source context of the authentication signal, it incorrectly grants the attacker an active session associated with an arbitrary user identity.\nThe vulnerable component is the core authentication handler of the Internationalization Single Sign-On module. Since the module integrates directly with the Drupal user authentication system, this bypass can escalate to full application compromise.\nThis flaw is exploitable over the network without requiring any prior authentication or local access to the server. The lack of strict verification allows for automated exploitation scripts to probe endpoints and perform mass account takeover or unauthorized access.\nPost-exploitation impact includes the ability to perform any action the impersonated user is authorized to execute within the Drupal environment. If an administrator is impersonated, the attacker gains full control over the CMS, including the capability to modify configurations, install malicious modules, or extract sensitive data from the underlying database.\nThe vulnerability persists across versions 0.0.0 through 1.8.0, indicating a systemic failure in the authentication design that has existed throughout the module's release lifecycle prior to discovery."
}