# DRUPAL-CONTRIB-2020-038 - This module enables your users residing at a SAML 2.0 compliant Identity Provider to login…

Source: https://junglewise.ai/threats/drupal-contrib-2020-038-this-module-enables-your-users-residing-at-a-344127de  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-11-18  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-11-18

This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website.

The module has two Authentication Bypass vulnerabilities.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml](https://junglewise.ai/threats/technologies/drupal-miniorange-saml). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 18 November 2020.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=2.14.0.

**Is there a fix for This vulnerability?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 2.14.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=2.14.0

## Related threats

- [miniorange_saml SAML Service Provider URL validation bypass](https://junglewise.ai/threats/cve-2026-87953-drupal-contrib-2026-151-this-module-allows-you-to-configure-your)
- [Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials.](https://junglewise.ai/threats/cve-2026-87952-drupal-contrib-2026-150-this-module-allows-you-to-configure-your)
- [Drupal SAML SSO Service Provider information disclosure in configuration storage](https://junglewise.ai/threats/cve-2026-87951-drupal-contrib-2026-149-this-module-allows-you-to-configure-your)
- [miniOrange SAML Service Provider embedded credentials information disclosure](https://junglewise.ai/threats/cve-2026-87950-drupal-contrib-2026-148-this-module-allows-you-to-configure-your)
- [SAML SSO Service Provider cross-site scripting in SAML assertion display](https://junglewise.ai/threats/cve-2026-87949-drupal-contrib-2026-147-this-module-allows-you-to-configure-your)