Description

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T13:18:08.413Z",
  "pubdate": "2026-09-02T13:18:08.413Z",
  "executiveSummary": "The Drupal External Authentication module is susceptible to a privilege escalation vulnerability stemming from improper handling of case sensitivity during the authentication process.\nThe vulnerability allows an attacker to manipulate user identifiers by exploiting case-insensitive comparisons, potentially mapping unauthorized requests to existing administrative or privileged accounts.\nAffected versions range from 0.0.0 through 2.0.13.\nSuccessful exploitation grants an unauthorized user the ability to assume the identity of another user, leading to potential account takeover and unauthorized administrative access.\nThis flaw exists within the module's logic for processing external authentication identifiers, failing to enforce strict case-sensitive validation against the local Drupal user database.\nThe risk implication is critical, as it bypasses standard authentication controls and enables malicious actors to elevate privileges without possessing valid credentials for the targeted account.",
  "technicalDetails": "The root cause of this vulnerability lies in the inconsistent normalization of usernames or external identifiers when the Drupal External Authentication module interfaces with the Drupal user authentication system. By failing to strictly enforce case sensitivity, the module creates a discrepancy between how the external provider identifies a user and how the Drupal database retrieves that account.\nIn environments where the underlying database collation is case-insensitive—a common configuration in many MySQL or MariaDB setups—the system may treat distinct strings (e.g., 'User' and 'user') as identical. If the authentication module does not explicitly sanitize or force case consistency, an attacker can input a variation of an existing, higher-privileged username that the backend database erroneously equates to an existing record.\nThe attack flow begins when an attacker identifies a target account, such as an administrator, and initiates an authentication request via the external provider using a casing variant that differs from the primary key stored in the Drupal database. Because the External Authentication module fails to reject or properly canonicalize these inputs, the module processes the request based on the database's case-insensitive lookup mechanism.\nUpon a successful match, the module triggers the Drupal session management system to log the attacker in as the targeted privileged user. This effectively bypasses the authentication logic that should be verifying the identity based on the exact, case-sensitive unique identifier.\nAffected components include the authentication service layer of the Drupal External Authentication module (versions 0.0.0 through 2.0.13). The exploitation is typically performed over the network, and the attacker does not necessarily require prior authentication, depending on the specific external authentication provider's configuration.\nThe post-exploitation impact is severe, resulting in complete unauthorized access to the session of the targeted user. If the targeted account holds administrative privileges, the attacker gains full control over the Drupal instance, facilitating site-wide manipulation, data exfiltration, or further persistence within the server environment."
}