CVE-2026-87947
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Drupal SAML SSO - Service Provider module contains an improper cryptographic signature verification vulnerability enabling signature spoofing. The issue affects versions from 0.0.0 to 3.2.0.
Risk Assessment
An attacker could forge signed SAML assertions, potentially bypassing authentication and gaining unauthorized access to the application.
Recommendation
Update the SAML SSO - Service Provider module to a version later than 3.2.0 that includes the signature verification fix.
Other vulnerabilities in Drupal SAML SSO - Service Provider
See all- CVE-2026-87953Low
A Server-Side Request Forgery (SSRF) vulnerability in the Drupal SAML SSO - Service Provider module allows server-side request forgery. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87952Low
The Drupal SAML SSO - Service Provider module is vulnerable to authentication bypass via capture-replay, allowing remote services with stolen credentials. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87951Low
The Drupal SAML SSO - Service Provider module in versions from 0.0.0 to 3.2.0 stores sensitive information insecurely, allowing retrieval of embedded sensitive data. The vulnerability concerns improper protection of data stored by the module.
- CVE-2026-87950Medium
The Drupal SAML SSO - Service Provider module contains a use of hard-coded credentials vulnerability, allowing retrieval of embedded sensitive data. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87949Low
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87948Low
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87945Medium
The Drupal SAML SSO - Service Provider module contains an open redirect vulnerability, allowing faking the source of data by redirecting users to an untrusted site. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87944Medium
The Drupal SAML SSO - Service Provider module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87943Medium
The Drupal SAML SSO - Service Provider module contains a missing authorization vulnerability, allowing forceful browsing. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-5343High
The SAML SSO - Service Provider plugin for Drupal contains an improper check for unusual or exceptional conditions vulnerability, allowing privilege escalation. This affects versions from 0.0.0 before 3.1.4.
Original NVD description (English source)
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS