Drupal SAML SSO Service Provider vulnerabilities

2 vulnerabilities

Known vulnerabilities in Drupal SAML SSO Service Provider, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

3.3LowCVE-2026-87953drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.15%3.1LowCVE-2026-87952drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.19%3.8LowCVE-2026-87951drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.15%5.3MediumCVE-2026-87950drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.14%3.3LowCVE-2026-87949drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.16%3.5LowCVE-2026-87948drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.16%4.8MediumCVE-2026-87947drupal · saml sso - service providerSAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.10%4.8MediumCVE-2026-87946drupal · saml sso - service providerSAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.15%5.4MediumCVE-2026-87945drupal · saml sso - service providerSAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.14%4.8MediumCVE-2026-87944drupal · saml sso - service providerSAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.10%6.5MediumCVE-2026-87943drupal · saml sso - service providerSAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.EPSS0.14%7.4HighCVE-2026-5343drupal · saml sso - service provider +1 moreSAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.EPSS0.34%6.1MediumCVE-2026-3217drupal · saml sso - service provider +1 moreSAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.EPSS0.26%