17683 matches found
SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users ...
Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
This module enables you to turn a Drupal install into the Central Authentication System CAS Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during...
amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize...
Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous...
Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...
SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...
SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...
SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...
SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module uses cryptographic constructions that do not align with current security best practices. The module performs certain signature...
PT-2026-95856
TuxCare rebuilt drupal/openid connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare...
PT-2026-95865
TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 3.2.0-p1+tuxcare...
SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...
PT-2026-89252
Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module does no...
PT-2026-89251
Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description An authentication bypass issue exists where the module does not sufficiently prevent the reuse of previously accepted SAML assertions. This allows a valid assertion to...
PT-2026-89236
Name of the Vulnerable Software and Affected Versions amazee.ai Drupal provider versions prior to 1.3.7 amazee.ai Drupal provider versions prior to 1.4.3 Description The module integrates AI services into Drupal, utilizing a Postgres/pgvector vector database backend for Search API AI Search. The...
PT-2026-89237
Name of the Vulnerable Software and Affected Versions Drupal Central Authentication System CAS Server versions 0.0.0 through 2.0.4 Drupal Central Authentication System CAS Server versions 2.1.0 through 2.1.3 Description An open redirect issue exists because the module does not sufficiently valida...
PT-2026-89244
Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The miniorange saml module does not sufficiently validate certain user-supplied URLs before performing redirects. This allows an attacker to redirect users to an...