CVE-2026-16639

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Drupal Internationalization Single Sign-On

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: Drupal.org

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-16639

EUVD

EUVD-2026-66181

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	internationalization_single_sign_on	From 0.0.0 (inc) to 1.8.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authentication Bypass Using an Alternate Path or Channel in Drupal Internationalization Single Sign-On. It allows attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the system.

Detection Guidance

To detect this vulnerability, check if your Drupal Internationalization Single Sign-On module is running a version between 0.0.0 and 1.8.0. Use commands like 'drush pm-list' or inspect the module's info file to verify the version. If vulnerable, update immediately.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data or perform actions as an authenticated user. Systems running vulnerable versions of Internationalization Single Sign-On (0.0.0 to 1.8.0) are at risk.

Compliance Impact

This vulnerability allows authentication bypass, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or protected health information.

Mitigation Strategies

Update Internationalization Single Sign-On to the latest version beyond 1.8.0 to address the authentication bypass issue.

Hi! I’m here to help you understand CVE-2026-16639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70