View online: https://www.drupal.org/sa-contrib-2026-115 Project: LDAP / Active Directory Integration [1] Date: 2026-August-26 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Proof/TD:All [2] Vulnerability: Information Disclosure Affected versions: <2.2.1 CVE IDs: CVE-2026-81205 Description: This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to. Solution: Install the latest version: * If you use the LDAP / Active Directory Integration module, upgrade to LDAP / Active Directory Integration 2.2.1 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Harshvardhan Soni (sharsh) [5] * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/ldap_auth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ldap_auth/releases/2.2.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/sharsh [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....