Executive brief
The miniorange_saml module for Drupal enables single sign-on through SAML 2.0, allowing users to authenticate via an external identity provider. The module fails to properly prevent replay attacks on SAML assertions, which means a previously captured login token could be reused multiple times during its validity window, potentially allowing unauthorized account access. An attacker must first intercept a valid SAML assertion to exploit this flaw, limiting the practical risk but still enabling account compromise during the assertion's active period.
Technical details
The vulnerability is an insufficient replay protection flaw in SAML assertion validation. The module accepts SAML assertions without properly tracking their prior use, allowing the same assertion to be replayed within its validity period for repeated authentication. This is a network-based attack requiring an attacker to obtain a valid SAML assertion from a legitimate user or identity provider interaction, with impact on authentication integrity. The fix was released in version 3.2.0.
Affected products
- Drupal miniorange_saml before 3.2.0
Timeline
- 2026-09-09: disclosed