# CVE-2026-3217: DRUPAL-CONTRIB-2026-018 - This module enables you to perform SAML protocol-based single sign-on (SSO) on a Drupal…

Source: https://junglewise.ai/threats/cve-2026-3217-drupal-contrib-2026-018-this-module-enables-you-to-perform-saml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25  
License: CC BY 4.0 with a link back

CVE-2026-3217 · Severity: info · Published 2026-02-25

This module enables you to perform SAML protocol-based single sign-on (SSO) on a Drupal site.

The module doesn't sufficiently sanitize user input, leading to a reflected Cross-site scripting (XSS) vulnerability.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml](https://junglewise.ai/threats/technologies/drupal-miniorange-saml). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-3217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3217 being exploited in the wild.

**How severe is CVE-2026-3217?** Informational severity, published 25 February 2026.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=3.1.3.

**Is there a fix for CVE-2026-3217?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-3217?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.1.3 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=3.1.3

## Identifiers

- CVE-2026-3217
- DRUPAL-CONTRIB-2026-018

## Related threats

- [miniorange_saml SAML Service Provider URL validation bypass](https://junglewise.ai/threats/cve-2026-87953-drupal-contrib-2026-151-this-module-allows-you-to-configure-your)
- [Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials.](https://junglewise.ai/threats/cve-2026-87952-drupal-contrib-2026-150-this-module-allows-you-to-configure-your)
- [Drupal SAML SSO Service Provider information disclosure in configuration storage](https://junglewise.ai/threats/cve-2026-87951-drupal-contrib-2026-149-this-module-allows-you-to-configure-your)
- [miniOrange SAML Service Provider embedded credentials information disclosure](https://junglewise.ai/threats/cve-2026-87950-drupal-contrib-2026-148-this-module-allows-you-to-configure-your)
- [SAML SSO Service Provider cross-site scripting in SAML assertion display](https://junglewise.ai/threats/cve-2026-87949-drupal-contrib-2026-147-this-module-allows-you-to-configure-your)