CVE-2026-73476: CWE-178 Improper Handling of Case Sensitivity in Drupal External Authentication

This vulnerability (CVE-2026-73476) in Drupal External Authentication arises from improper handling of case sensitivity (CWE-178) during authentication processes. The issue allows an attacker with some privileges to escalate their privileges further by exploiting case sensitivity mismatches. The affected versions range from 0.0.0 through 2.0.13. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact. No vendor advisory or patch is currently available, and no known active exploitation has been reported.

An attacker with some level of privileges can exploit this vulnerability to escalate their privileges further due to improper case sensitivity handling in authentication. This could lead to unauthorized access to additional resources or functions within the Drupal External Authentication module. The confidentiality and integrity impacts are limited but present, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for updates from Drupal regarding this vulnerability. No official remediation or workaround is currently published.