Executive brief
Drupal's External Authentication module is used to authenticate users against external identity providers and store their authentication details. A case sensitivity flaw in how authentication mappings are compared allows attackers to bypass access controls on sites using certain MySQL or MariaDB collation settings, potentially gaining unauthorized access to user accounts.
Technical details
The vulnerability is an improper handling of case sensitivity in the external authentication identity matching logic. The module fails to ensure exact matching of externally supplied identity values when storing and looking up authentication mappings, particularly under specific database collation configurations. The attack vector is network-based and does not require authentication or user interaction. An attacker can exploit case sensitivity differences in the database collation to match authentication mappings they should not have access to, effectively bypassing access controls. The vulnerability affects External Authentication versions prior to 2.0.13, which contains the fix.
Affected products
- Drupal External Authentication <2.0.13
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Version 2.0.13 released with fix