How severe is CVE-2026-1554?

CVE-2026-1554 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-1554 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-1554?

CVE-2026-1554 affects Jtenman Central Authentication System Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-1554?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-1554 have an EU (EUVD) identifier?

Yes. CVE-2026-1554 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5352.

When was CVE-2026-1554 published?

CVE-2026-1554 was published on 2026-02-04 and last updated on 2026-06-17.

CVE-2026-1554

CVE-2026-1554 is a medium-severity vulnerability in Jtenman Central Authentication System Server with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-91.

Key facts

Severity: Medium (CVSS 3.x base score 4.2)
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-5352
Weakness: CWE-91
Affected product: Jtenman Central Authentication System Server
Published: 2026-02-04
Last modified: 2026-06-17

Description

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

Frequently asked questions

What is CVE-2026-1554?: XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
How severe is CVE-2026-1554?: CVE-2026-1554 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-1554 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-1554?: CVE-2026-1554 affects Jtenman Central Authentication System Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-1554?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-1554 have an EU (EUVD) identifier?: Yes. CVE-2026-1554 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5352.
When was CVE-2026-1554 published?: CVE-2026-1554 was published on 2026-02-04 and last updated on 2026-06-17.

References

https://www.drupal.org/sa-contrib-2026-007

Affected products (1)

cpe:2.3:a:jtenman:central_authentication_system_server:*:*:*:*:*:drupal:*:*

Other CWE-91 (XML Injection) vulnerabilities

CVE-2021-4140 — Critical (CVSS 10.0): It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability…
CVE-2023-43187 — Critical (CVSS 9.8): A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to…
CVE-2019-19450 — Critical (CVSS 9.8): paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates…
CVE-2021-37154 — Critical (CVSS 9.8): In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a…
CVE-2020-29128 — Critical (CVSS 9.8): petl before 1.68, in some configurations, allows resolution of entities in an XML document.
CVE-2020-25216 — Critical (CVSS 9.8): yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction…

Browse all CWE-91 (XML Injection) vulnerabilities →