The i18n_sso module in Drupal enables automatic single sign-on across multiple language domains on a multilingual website. However, it does not sufficiently validate a short-lived token used for authentication, which allows an attacker to bypass access control and impersonate a victim user. The vulnerability requires the attacker to appear to originate from the same client IP address as the victim, which mitigates the risk somewhat. This issue affects all versions of the module before 1.8.0. There is no information about an official patch or fix in the provided data.

An attacker who can appear to originate from the same client IP as a victim can bypass access control and authenticate as that victim user across language domains on the website. This could lead to unauthorized access to user accounts and potentially sensitive information. The requirement for the attacker to share the victim's IP address limits the exploitability of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should be aware of the risk and consider network-level controls to restrict IP spoofing or monitor for suspicious authentication activity from shared IP addresses. No vendor advisory or patch links are provided in the current data.