CVE-2026-87952
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Drupal SAML SSO - Service Provider module is vulnerable to authentication bypass via capture-replay, allowing remote services with stolen credentials. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
Risk Assessment
An attacker in possession of captured SAML credentials can impersonate a user and gain access to protected resources. This may lead to unauthorized access to applications and data.
Recommendation
Update the SAML SSO - Service Provider module to a version later than 3.2.0. Consider reviewing SAML security configuration, including assertion replay protection.
Other vulnerabilities in Drupal SAML SSO - Service Provider
See all- CVE-2026-87953Low
A Server-Side Request Forgery (SSRF) vulnerability in the Drupal SAML SSO - Service Provider module allows server-side request forgery. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87951Low
The Drupal SAML SSO - Service Provider module in versions from 0.0.0 to 3.2.0 stores sensitive information insecurely, allowing retrieval of embedded sensitive data. The vulnerability concerns improper protection of data stored by the module.
- CVE-2026-87950Medium
The Drupal SAML SSO - Service Provider module contains a use of hard-coded credentials vulnerability, allowing retrieval of embedded sensitive data. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87949Low
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87948Low
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87947Medium
The Drupal SAML SSO - Service Provider module contains an improper cryptographic signature verification vulnerability enabling signature spoofing. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87945Medium
The Drupal SAML SSO - Service Provider module contains an open redirect vulnerability, allowing faking the source of data by redirecting users to an untrusted site. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-87944Medium
The Drupal SAML SSO - Service Provider module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 3.2.0.
- CVE-2026-87943Medium
The Drupal SAML SSO - Service Provider module contains a missing authorization vulnerability, allowing forceful browsing. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
- CVE-2026-5343High
The SAML SSO - Service Provider plugin for Drupal contains an improper check for unusual or exceptional conditions vulnerability, allowing privilege escalation. This affects versions from 0.0.0 before 3.1.4.
Original NVD description (English source)
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS