View online: https://www.drupal.org/sa-contrib-2026-145 Project: SAML SSO - Service Provider [1] Date: 2026-September-09 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Authentication bypass Affected versions: <3.2.0 CVE IDs: CVE-2026-87947 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced by the incoming response rather than being tied to the type of key configured for the Identity Provider (IdP). The vulnerability is mitigated by the fact that an attacker must be able to submit a crafted SAML response to the affected site. Solution: Install the latest version: * Upgrade to SAML SSO - Service Provider 3.2.0 [3]. Reported By: * Timo De Clercq (timodc) [4] Fixed By: * Roushan Kumar Singh (roushan59227) [5] * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Heine Deelstra (heine) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team * Swan Kalata (akalata) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/miniorange_saml [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_saml/releases/3.2.0 [4] https://www.drupal.org/u/timodc [5] https://www.drupal.org/u/roushan59227 [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/heine [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://www.drupal.org/u/akalata [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....