Is CVE-2026-5343 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5343 being exploited in the wild.

How severe is CVE-2026-5343?

Informational severity, with a CVSS score of 9.8, published 28 May 2026.

Is there a fix for CVE-2026-5343?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5343 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5343?

Check whether you run Drupal SAML SSO - Service Provider or Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5343: Drupal SAML SSO - Service Provider authentication bypass

CVE-2026-5343 · Severity: info · CVSS 9.8 · Published 2026-05-28

A critical security vulnerability exists in the Drupal SAML SSO - Service Provider module, which is used to allow users to sign into Drupal websites using external identity providers. This flaw allows an attacker to bypass authentication and gain unauthorized access to user accounts, potentially including administrative accounts. This could lead to full site takeover, data theft, or unauthorized modification of website content.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-5343 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5343 being exploited in the wild.
How severe is CVE-2026-5343?: Informational severity, with a CVSS score of 9.8, published 28 May 2026.
Which products and versions are affected?: Drupal SAML SSO - Service Provider >= 0.0.0, < 3.1.4; Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=3.1.4.
Is there a fix for CVE-2026-5343?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5343 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5343?: Check whether you run Drupal SAML SSO - Service Provider or Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.1.4 or later

Technical details

The Drupal SAML SSO - Service Provider module fails to sufficiently validate authentication responses, leading to an 'Improper Check for Unusual or Exceptional Conditions' (CWE-754). This vulnerability allows a remote, unauthenticated attacker to bypass the SAML authentication process and log in as any user, including administrators, by exploiting flaws in how the module handles SAML assertions or exceptional conditions during the SSO handshake. The issue affects all versions prior to 3.1.4. Users are advised to upgrade to version 3.1.4 immediately to remediate the risk.

Affected products

Drupal SAML SSO - Service Provider >= 0.0.0, < 3.1.4

Identifiers

CVE-2026-5343
DRUPAL-CONTRIB-2026-031

Timeline

2026-04-01: advisory: Drupal Security Team published SA-CONTRIB-2026-031
2026-05-28: disclosed: CVE-2026-5343 published to NVD
2026-04-01: patched: Version 3.1.4 released to address the vulnerability

References

https://www.drupal.org/sa-contrib-2026-031

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.