Executive brief
The Internationalization Single Sign-On module for Drupal enables automatic cross-domain login for multilingual sites. A flaw in token validation allows attackers from the same IP address as a victim to forge valid authentication tokens and hijack user accounts, bypassing access controls. This could allow unauthorized users to gain full account access on affected Drupal installations.
Technical details
The vulnerability is an authentication bypass caused by insufficient validation of short-lived tokens used in the cross-domain single sign-on flow. The module generates time-limited tokens (10-minute lifetime) to allow users to log into satellite domains after authenticating on the primary domain. An attacker can forge or reuse these tokens to authenticate as a victim user without valid credentials. The attack requires the attacker to originate from the same client IP as the victim. The vulnerable versions are 0.0.0 through 1.8.0; version 1.8.0 or later and 2.0.0+ contain the fix. The module is network-accessible via the i18n_sso/* endpoints and requires HTTPS deployment for proper security (as documented by the maintainers).
Affected products
- Drupal Internationalization Single Sign-On 0.0.0 to 1.8.0
Timeline
- 2026-07-22: disclosed: Drupal Security Advisory SA-CONTRIB-2026-081 published
- 2026-07-26: patched: Version 1.8.0 released for Drupal 10/11; version 2.0.0 released for Drupal 11.4+/12
- 2026-08-25: advisory: CVE-2026-16639 published on NVD