EUVD-2026-107858

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87943

The miniorange_saml module for Drupal contains a Missing Authorization vulnerability (CWE-862) affecting versions 0.0.0 to 3.2.0 . The root cause is that the module fails to properly restrict access to certain functions intended exclusively for administrative use. This oversight allows for Forcef...

EUVD-2026-107857

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle AiTM. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87944

The Drupal SAML SSO - Service Provider module (versions 0.0.0 to 3.2.0 ) is vulnerable to Improper Certificate Validation (CWE-295). The module fails to properly validate TLS certificates when making outbound HTTPS requests to external identity providers. This flaw allows an Adversary in the Midd...

EUVD-2026-107855

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107856

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87945

The miniorange_saml module for Drupal is vulnerable to an Open Redirect (CWE-601) because it fails to sufficiently validate certain user-supplied URLs before performing redirects. This flaw affects versions 0.0.0 through 3.2.0 . An attacker could exploit this to redirect users to an external webs...

CVE-2026-87946

The Drupal SAML SSO - Service Provider module (versions 0.0.0 to 3.2.0 ) is vulnerable to an Observable Timing Discrepancy (CWE-208) due to weak cryptographic practices. Specifically, the module performs signature comparisons using non constant-time comparison logic and generates SAML request ide...

EUVD-2026-107854

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87947

The SAML SSO - Service Provider module for Drupal (versions 0.0.0 to 3.2.0 ) is vulnerable to an authentication bypass due to improper verification of cryptographic signatures. The root cause is that the module fails to restrict which signature algorithm is used to validate a SAML assertion , all...

EUVD-2026-107853

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting XSS. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87948

The Drupal SAML SSO - Service Provider module is vulnerable to Cross-Site Scripting (XSS) because it fails to sufficiently sanitize user-supplied data before including it in generated HTML. This issue affects versions from 0.0.0 to 3.2.0 . An attacker could potentially execute malicious scripts i...

EUVD-2026-107852

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting XSS. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87949

The Drupal SAML SSO - Service Provider module (versions 0.0.0 to 3.2.0) is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is the failure to sufficiently sanitize certain values derived from SAML assertions before they ar...

EUVD-2026-107851

Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87950

The Drupal SAML SSO - Service Provider module (versions 0.0.0 to 3.2.0 ) is vulnerable to a Use of Hard-coded Credentials (CWE-798) issue. The module contains embedded credentials necessary for its functionality, which could allow an attacker to retrieve embedded sensitive data or disclose inform...

EUVD-2026-107850

Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107849

Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87952

The SAML SSO - Service Provider module for Drupal (versions 0.0.0 to 3.2.0 ) contains an authentication bypass vulnerability due to insufficient replay protection . The module fails to adequately prevent the reuse of previously accepted SAML assertions . This allows an attacker to replay a valid ...

CVE-2026-87951

The Drupal SAML SSO - Service Provider module (versions 0.0.0 to 3.2.0 ) contains an Insecure Storage of Sensitive Information vulnerability (CWE-922). The module stores sensitive authentication information in a manner that could allow disclosure to users who have access to configuration or relat...