EUVD-2026-107857

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle AiTM. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87944

The Drupal SAML SSO - Service Provider module (versions 0.0.0 through 3.2.0 ) contains an Improper Certificate Validation vulnerability. The root cause is that the module fails to properly validate TLS certificates during outbound HTTPS requests. This allows an Adversary in the Middle (AiTM) to i...

CVE-2026-87944

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle AiTM. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87944 SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle AiTM. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87944 SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle AiTM. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87945

The Drupal SAML SSO - Service Provider module (specifically the miniorange_saml module) is vulnerable to an Open Redirect (CWE-601) in versions 0.0.0 through 3.2.0 . The root cause is the failure to sufficiently validate certain user-supplied URLs before performing redirects. An attacker can expl...

CVE-2026-87945 SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87945 SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87945 SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87946

The Drupal SAML SSO - Service Provider module, affecting versions 0.0.0 through 3.2.0 , is vulnerable to an Observable Timing Discrepancy . The root cause is the use of non constant-time comparison logic during signature comparisons, which may facilitate brute force attacks . Additionally, the mo...

CVE-2026-87946

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107856

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87946 SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107855

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87946 SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87946 SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87947 SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87947 SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87947

The Drupal SAML SSO - Service Provider module (versions 0.0.0 through 3.2.0 ) is vulnerable to an Improper Verification of Cryptographic Signature (CWE-347). The root cause is that the module fails to restrict which signature algorithm is used to validate a SAML assertion; instead, the algorithm ...

EUVD-2026-107854

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...