# DRUPAL-CONTRIB-2021-036 - This module provides a solution to authenticate visitors using existing SAML providers…

Source: https://junglewise.ai/threats/drupal-contrib-2021-036-this-module-provides-a-solution-to-authenticate-66c8cb64  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-22  
License: CC BY 4.0 with a link back

Severity: info · Published 2021-09-22

This module provides a solution to authenticate visitors using existing SAML providers.

Certain non-default configurations allow a malicious user to login as any chosen user.

The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml](https://junglewise.ai/threats/technologies/drupal-miniorange-saml). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 22 September 2021.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=2.24.0.

**Is there a fix for This vulnerability?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 2.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml: upgrade to 2.24.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange Saml ECOSYSTEM:introduced=0,fixed=2.24.0

## Related threats

- [miniorange_saml SAML Service Provider URL validation bypass](https://junglewise.ai/threats/cve-2026-87953-drupal-contrib-2026-151-this-module-allows-you-to-configure-your)
- [Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials.](https://junglewise.ai/threats/cve-2026-87952-drupal-contrib-2026-150-this-module-allows-you-to-configure-your)
- [Drupal SAML SSO Service Provider information disclosure in configuration storage](https://junglewise.ai/threats/cve-2026-87951-drupal-contrib-2026-149-this-module-allows-you-to-configure-your)
- [miniOrange SAML Service Provider embedded credentials information disclosure](https://junglewise.ai/threats/cve-2026-87950-drupal-contrib-2026-148-this-module-allows-you-to-configure-your)
- [SAML SSO Service Provider cross-site scripting in SAML assertion display](https://junglewise.ai/threats/cve-2026-87949-drupal-contrib-2026-147-this-module-allows-you-to-configure-your)