CVE-2012-4494: The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users,...

Security readout for executives and security teams

This flaw affects the Shibboleth authentication module 7.x-4.0 for Drupal. A user who was blocked in Drupal could still log in through Shibboleth, bypassing intended account restrictions. The source bundle does not provide CVSS scoring, confirmed impact beyond bypass, or active exploitation evidence. Exposure is likely limited to Drupal sites using the Shibboleth authentication module 7.x-4.0, especially where blocked Drupal accounts are relied on to remove access. Treat as a targeted access-control bypass for legacy Drupal Shibboleth deployments. Prioritize if the organization used blocked accounts to revoke access or still runs this module version. Mitigation focus: Inventory Drupal sites for Shibboleth authentication module 7.x-4.0.; Review the referenced Drupal advisory, issue, and commit for maintainer-approved remediation.; Apply only vendor-confirmed updates or configuration changes for this module..

Prepared

Jun 24, 2026, 19:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.