Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. (CVE-2026-16639)

CVE-2026-16639 describes an authentication bypass vulnerability in the Drupal Internationalization Single Sign-On module. The flaw allows attackers to bypass authentication by using an alternate path or channel. The affected versions range from the initial release (0.0.0) through 1.8.0, with versions prior to 1.8.0 being vulnerable. No CVSS score is provided, and no known exploits in the wild have been reported. There is no information about an available patch or vendor advisory in the provided data.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication controls, potentially gaining unauthorized access to systems or data protected by the affected Single Sign-On module. This could lead to unauthorized actions or data exposure within Drupal environments using the vulnerable module versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected module and monitor for unusual authentication activity. Avoid deploying the affected versions in production environments if possible.