Executive brief
The SAML SSO - Service Provider module for Drupal allows website administrators to enable single sign-on through external identity providers. A flaw in URL validation allows attackers with permission to configure the identity provider metadata to redirect the application to unintended destinations, potentially exposing internal network resources. This requires the attacker to already have administrative configuration access to the module.
Technical details
The module fails to sufficiently validate URLs parsed from identity provider metadata, leading to a server-side request forgery (SSRF) vulnerability. An authenticated attacker with permission to configure identity provider metadata can inject malicious URLs that cause the Drupal application to make requests to internal network resources or unintended external destinations. The vulnerability is mitigated by requiring administrative privileges to configure the metadata.
Affected products
- miniorange miniorange_saml before 3.2.0
Timeline
- 2026-09-09: disclosed: Advisory published
- 2026-09-09: patched: Fix released in version 3.2.0