CVE-2026-16639: Drupal Internationalization Single Sign-On authentication bypass in token validation

CVE-2026-16639 · Severity: critical · CVSS 9.8 · Published 2026-08-25

The Internationalization Single Sign-On module for Drupal enables automatic cross-domain login for multilingual sites. A flaw in token validation allows attackers from the same IP address as a victim to forge valid authentication tokens and hijack user accounts, bypassing access controls. This could allow unauthorized users to gain full account access on affected Drupal installations.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-16639 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16639 being exploited in the wild.
How severe is CVE-2026-16639?
Critical severity, with a CVSS score of 9.8, published 25 August 2026.
Which products and versions are affected?
Drupal Internationalization Single Sign-On 0.0.0 to 1.8.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso ECOSYSTEM:introduced=0,fixed=1.8.0.
Is there a fix for CVE-2026-16639?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso: upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16639 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-16639?
Check whether you run Drupal Internationalization Single Sign-On or Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso: upgrade to 1.8.0 or later

Technical details

The vulnerability is an authentication bypass caused by insufficient validation of short-lived tokens used in the cross-domain single sign-on flow. The module generates time-limited tokens (10-minute lifetime) to allow users to log into satellite domains after authenticating on the primary domain. An attacker can forge or reuse these tokens to authenticate as a victim user without valid credentials. The attack requires the attacker to originate from the same client IP as the victim. The vulnerable versions are 0.0.0 through 1.8.0; version 1.8.0 or later and 2.0.0+ contain the fix. The module is network-accessible via the i18n_sso/* endpoints and requires HTTPS deployment for proper security (as documented by the maintainers).

Affected products

  • Drupal Internationalization Single Sign-On 0.0.0 to 1.8.0

Identifiers

  • CVE-2026-16639
  • DRUPAL-CONTRIB-2026-081

Timeline

  • 2026-07-22: disclosed: Drupal Security Advisory SA-CONTRIB-2026-081 published
  • 2026-07-26: patched: Version 1.8.0 released for Drupal 10/11; version 2.0.0 released for Drupal 11.4+/12
  • 2026-08-25: advisory: CVE-2026-16639 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.