CVE-2026-87952: Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials.

CVE-2026-87952 · Severity: info · Published 2026-10-22

The miniorange_saml module for Drupal enables single sign-on through SAML 2.0, allowing users to authenticate via an external identity provider. The module fails to properly prevent replay attacks on SAML assertions, which means a previously captured login token could be reused multiple times during its validity window, potentially allowing unauthorized account access. An attacker must first intercept a valid SAML assertion to exploit this flaw, limiting the practical risk but still enabling account compromise during the assertion's active period.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-87952 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87952 being exploited in the wild.
How severe is CVE-2026-87952?
Informational severity, published 22 October 2026.
Which products and versions are affected?
Drupal Miniorange Saml before 3.2.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2026-87952?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87952 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-87952?
Check whether you run Drupal Miniorange Saml or Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 3.2.0 or later

Technical details

The vulnerability is an insufficient replay protection flaw in SAML assertion validation. The module accepts SAML assertions without properly tracking their prior use, allowing the same assertion to be replayed within its validity period for repeated authentication. This is a network-based attack requiring an attacker to obtain a valid SAML assertion from a legitimate user or identity provider interaction, with impact on authentication integrity. The fix was released in version 3.2.0.

Affected products

  • Drupal miniorange_saml before 3.2.0

Identifiers

  • CVE-2026-87952
  • DRUPAL-CONTRIB-2026-150

Timeline

  • 2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.