# CVE-2026-16639: Drupal Internationalization Single Sign-On authentication bypass in token validation

Source: https://junglewise.ai/threats/cve-2026-16639-drupal-internationalization-single-sign-on-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16639 · Severity: critical · CVSS 9.8 · Published 2026-08-25

The Internationalization Single Sign-On module for Drupal enables automatic cross-domain login for multilingual sites. A flaw in token validation allows attackers from the same IP address as a victim to forge valid authentication tokens and hijack user accounts, bypassing access controls. This could allow unauthorized users to gain full account access on affected Drupal installations.

Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-16639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16639 being exploited in the wild.

**How severe is CVE-2026-16639?** Critical severity, with a CVSS score of 9.8, published 25 August 2026.

**Which products and versions are affected?** Drupal Internationalization Single Sign-On 0.0.0 to 1.8.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso ECOSYSTEM:introduced=0,fixed=1.8.0.

**Is there a fix for CVE-2026-16639?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso: upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16639 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16639?** Check whether you run Drupal Internationalization Single Sign-On or Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/I18n Sso: upgrade to 1.8.0 or later

## Technical details

The vulnerability is an authentication bypass caused by insufficient validation of short-lived tokens used in the cross-domain single sign-on flow. The module generates time-limited tokens (10-minute lifetime) to allow users to log into satellite domains after authenticating on the primary domain. An attacker can forge or reuse these tokens to authenticate as a victim user without valid credentials. The attack requires the attacker to originate from the same client IP as the victim. The vulnerable versions are 0.0.0 through 1.8.0; version 1.8.0 or later and 2.0.0+ contain the fix. The module is network-accessible via the i18n_sso/* endpoints and requires HTTPS deployment for proper security (as documented by the maintainers).

## Affected products

- Drupal Internationalization Single Sign-On 0.0.0 to 1.8.0

## Identifiers

- CVE-2026-16639
- DRUPAL-CONTRIB-2026-081

## Timeline

- 2026-07-22: disclosed: Drupal Security Advisory SA-CONTRIB-2026-081 published
- 2026-07-26: patched: Version 1.8.0 released for Drupal 10/11; version 2.0.0 released for Drupal 11.4+/12
- 2026-08-25: advisory: CVE-2026-16639 published on NVD

## References

- [https://www.drupal.org/project/i18n_sso](https://www.drupal.org/project/i18n_sso)
- [https://www.drupal.org/sa-contrib-2026-081](https://www.drupal.org/sa-contrib-2026-081)