Loading story…
Drupal issued security advisory SA-CONTRIB-2026-081 for a critical access bypass vulnerability in the Internationalization Single Sign-On contributed module. The flaw affects versions prior to 1.8.0, creating a risk that unauthorized users could bypass intended access controls in deployments using the module.
The Canadian Centre for Cyber Security republished the notice as AV26-738 and urged organizations to review Drupal’s guidance and apply the recommended update or mitigations. Administrators running the affected module have been directed to verify installed versions and move to a fixed release to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On July 22, 2026, Drupal published security advisory SA-CONTRIB-2026-081 for a critical access bypass vulnerability in the Internationalization Single Sign-On module. The issue affects versions prior to 1.8.0, and users were advised to apply the recommended updates or mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcedrupal.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Drupal disclosed **SA-CONTRIB-2026-031**, a critical authentication bypass vulnerability in the **SAML SSO - Service Provider** module affecting versions prior to `3.1.4`. The Canadian Centre for Cyber Security warned that organizations using the product should review Drupal’s guidance and apply the vendor update, as the flaw could allow unauthorized access through affected single sign-on deployments. Separately, Samba maintainers announced upcoming security releases for versions `4.22`, `4.23`, and `4.24` to address six vulnerabilities spanning file services, domain members, and Active Directory Domain Controller components. A follow-up correction said a **CVSS 10.0** file-services issue affects uncommon configurations rather than some configurations, and clarified that one Active Directory-related flaw impacts domain members rather than AD domain controllers; administrators were urged to deploy the Samba updates promptly after release.
Jun 29, 2026
German government CERT advisories reported a **Keycloak** vulnerability that can allow attackers to bypass security measures in deployments using the identity and access management platform. The issue was published in multiple advisories, indicating continued tracking and notification of the same security weakness affecting Keycloak environments. Organizations using Keycloak should review the affected product versions and vendor guidance tied to the advisories, assess whether authentication or access-control protections could be circumvented, and prioritize remediation. Because Keycloak is commonly used for **single sign-on** and identity federation, a successful bypass could weaken protections around user authentication and protected applications.
Jun 29, 2026
A critical broken authentication flaw tracked as **CVE-2026-57807** affects the miniOrange **OAuth Single Sign On - SSO (OAuth Client)** WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions **through 38.5.8** and is classified as **CWE-288**. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover. The vulnerability carries a **CVSS 9.8** rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.
Jul 13, 2026