CVE-2026-87943
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Drupal SAML SSO - Service Provider module contains a missing authorization vulnerability, allowing forceful browsing. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
Risk Assessment
An attacker could access resources or functions that should be unavailable without proper permissions, potentially leading to data disclosure or modification.
Recommendation
Update the SAML SSO - Service Provider module to a version later than 3.2.0 and review access control rules for protected paths.
Other vulnerabilities in Drupal SAML SSO - Service Provider
See all- CVE-2026-87953Low
A Server-Side Request Forgery (SSRF) vulnerability in the Drupal SAML SSO - Service Provider module allows server-side request forgery. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87952Low
The Drupal SAML SSO - Service Provider module is vulnerable to authentication bypass via capture-replay, allowing remote services with stolen credentials. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87951Low
The Drupal SAML SSO - Service Provider module in versions from 0.0.0 to 3.2.0 stores sensitive information insecurely, allowing retrieval of embedded sensitive data. The vulnerability concerns improper protection of data stored by the module.
- CVE-2026-87950Medium
The Drupal SAML SSO - Service Provider module contains a use of hard-coded credentials vulnerability, allowing retrieval of embedded sensitive data. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87949Low
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87948Low
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87947Medium
The Drupal SAML SSO - Service Provider module contains an improper cryptographic signature verification vulnerability enabling signature spoofing. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87945Medium
The Drupal SAML SSO - Service Provider module contains an open redirect vulnerability, allowing faking the source of data by redirecting users to an untrusted site. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87944Medium
The Drupal SAML SSO - Service Provider module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-5343High
The SAML SSO - Service Provider plugin for Drupal contains an improper check for unusual or exceptional conditions vulnerability, allowing privilege escalation. This affects versions from 0.0.0 before 3.1.4.
Original NVD description (English source)
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS