Drupal Security

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96363Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings.

This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Dan Chadwick (danchadwick)
• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Cathy Theys (yesct) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96362Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs.

The module does not sufficiently filter response values from the Remote Post handler before those values are rendered through handler response tokens. If a site uses Remote Post handler response tokens in rendered output, values returned by a configured remote endpoint could be rendered as HTML, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must be able to control or influence the response from a configured remote endpoint, and the site must use Remote Post handler response tokens in rendered output.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96359Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripting (XSS) when the element is rendered.

This vulnerability is mitigated by the fact that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected webform.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96358Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a rating element.

This vulnerability is mitigated by the fact that an attacker must be able to place crafted HTML markup on the same page as a Webform rating element.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96361Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, this can allow markup from counter-related settings to be inserted into the page leading to a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must be able to create or edit affected Webform elements, or place specially crafted counter markup on a page where the Webform counter JavaScript is active.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96360Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies.

In some configurations, due to improper sanitisation, specially crafted announcement text could create a cross-site scripting risk for users interacting with the affected Webform.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Date: 2026-September-21Description: 

• Updated 2026-09-22, 12:00 UTC, to document that the advisories in the release might be possible for more common configurations, and that other projects may have advisories.
• Updated 2026-09-21, 19:00 UTC, to document that this is not covered by Drupal Steward.

There will be a security release for a widely used contributed module on September 23, 2026 between 17:00 and 21:00 UTC.

We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories.

The advisory with the highest risk score for the release is currently rated as critical. Other, less severe advisories in the release may be accessible to anonymous users, or result from default configurations.

Other contributed projects may also release advisories on the same date, possibly with more severe vulnerabilities. Drupal core is not affected.

Drupal Steward information

These releases will not be covered by Drupal Steward.

Advisories may be published in batches (a few at a time)

The current rate of advisories may require changes to our practices going forward:

• The security team may publish advisories individually, at different times inside the window.
• We will try to publish batches grouped by module.
• We will announce in Slack when all planned releases for the day are complete.
• We will release mailing list emails about the security updates together at the end of the window, to reduce the risk of site owners updating multiple times while advisories are still being published.

These changes are intended to make the process easier for the team and to make communication from the team easier to follow.

No special release procedures

The planned update does not require special release procedures.

Solution: 

Update, 2026-09-23 18:30 UTC: The Webform project has released the below 20 advisories today. Make note of the critical advisory SA-CONTRIB-2026-175, which has slightly increased severity than was originally noted in this public service announcement.

Other advisories than those below were published for other projects, so site owners should follow all normal update procedures.

1. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
2. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
3. (Advisory numbers 156 and 157 were accidentally skipped in how we applied the numbering; these are not missing security advisories.)
4. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
5. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
6. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
7. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
8. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
9. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
10. Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
11. Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
12. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
13. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
14. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
15. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
16. Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
17. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
18. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
19. Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
20. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
21. Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Moshe Weitzman (moshe weitzman) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Drupal coreProject machine name: drupalDate: 2026-September-16Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Third-party librariesAffected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7Description: 

The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.

Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

• High-severity Cross-site scripting (XSS) in the engine package

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.7.
• If you use Drupal 11.3.x, update to Drupal 11.3.17.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.17.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Note that Drupal 8 and Drupal 9 have both reached end-of-life.

Instructions for contributed modules

Site owners should also review their site following the protocol for managing external libraries and plugins, as contributed projects may use additional CKEditor plugins not packaged in Drupal core.

CKEditor has also released another CVE in today's release that does not affect Drupal, but may affect custom plugins or other usecases:

• Low-severity Cross-site scripting (XSS) in the engine package

Reported By: 

• Piotrek Koszuliński (Reinmar)

Fixed By: 

• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Ultimate Table FieldProject machine name: ultimate_table_fieldDate: 2026-September-09Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.1.1 || >=2.0.0 <2.0.1CVE IDs: CVE-2026-87955Description: 

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.

The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.

This vulnerability is partially mitigated by the fact that only files with the pdf, doc and docx extensions are accepted.

Solution: 

Install the latest version and adjust permissions:

• If you use the 2.x branch of the Ultimate Table Field module , upgrade to Ultimate Table Field 2.0.1.
• If you use the 1.x branch of the Ultimate Table Field module , upgrade to Ultimate Table Field 1.1.1.

After updating, grant the new permission Use the Ultimate Table Field cell editor to every role that edits content containing an Ultimate Table field. Without it, editors can no longer open the cell editor dialog.

Releases of the 1.0.x branch are not supported and do not receive security coverage. Upgrade to 1.1.1 or 2.0.1.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Brahim Khouy (b.khouy)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: Taxonomy Term GlossaryProject machine name: term_glossaryDate: 2026-September-09Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <4.6.0CVE IDs: CVE-2026-87954Description: 

This module adds automatic highlighting of taxonomy terms in content.

The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise restricted.

Solution: 

Install the latest version:

• If you use the Taxonomy Term Glossary module, upgrade to term_glossary 4.6.0.

The 4.4.x and 4.5.x branches are no longer supported.

Reported By: 

• Hemant Gupta (guptahemant)
• Marcus Johansson (marcus_johansson)
• Serhii Checheniev (serhii-che)

Fixed By: 

• Frank Mably (mably)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Server Side Request ForgeryAffected versions: <3.2.0CVE IDs: CVE-2026-87953Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity provider metadata could cause the application to make requests to unintended destinations, potentially allowing access to internal network resources.

This vulnerability is mitigated by the fact that an attacker must have permission to configure identity provider metadata.

Solution: 

Install the latest version:

• Upgrade to miniorange_saml 3.2.0.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Insufficient replay protectionAffected versions: <3.2.0CVE IDs: CVE-2026-87952Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be replayed within its validity period, potentially allowing repeated authentication attempts using the same assertion.

This vulnerability is mitigated by the fact that an attacker must first obtain a valid SAML assertion and can only reuse it during the assertion's validity period.

Solution: 

Install the latest version:

• Upgrade to miniorange_saml 3.2.0.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Information disclosureAffected versions: <3.2.0CVE IDs: CVE-2026-87951Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related system data.

This vulnerability is mitigated by the fact that an attacker must first obtain access to configuration or underlying storage mechanisms.

Solution: 

Install the latest version:

• Upgrade to SAML SSO - Service Provider 3.2.0.

Reported By: 

• Sudhanshu Dhage (sudhanshu0542)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Embedded credentialsAffected versions: <3.2.0CVE IDs: CVE-2026-87950Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module contains embedded credentials used by the functionality provided by the module.

Under certain circumstances, these credentials could allow information about associated services to be disclosed.

Solution: 

Install the latest version:

• Upgrade to miniorange_saml 3.2.0.

Reported By: 

• Sudhanshu Dhage (sudhanshu0542)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <3.2.0CVE IDs: CVE-2026-87949Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provider or an attacker able to supply crafted SAML attributes, leading to a cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

• Upgrade to miniorange_saml 3.2.0.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <3.2.0CVE IDs: CVE-2026-87948Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting vulnerability (XSS).

Solution: 

Install the latest version:

• Upgrade to SAML SSO - Service Provider 3.2.0.

Reported By: 

• Sudhanshu Dhage (sudhanshu0542)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Authentication bypassAffected versions: <3.2.0CVE IDs: CVE-2026-87947Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced by the incoming response rather than being tied to the type of key configured for the Identity Provider (IdP).

The vulnerability is mitigated by the fact that an attacker must be able to submit a crafted SAML response to the affected site.

Solution: 

Install the latest version:

• Upgrade to SAML SSO - Service Provider 3.2.0.

Reported By: 

• Timo De Clercq (timodc)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Weak cryptographic practicesAffected versions: <3.2.0CVE IDs: CVE-2026-87946Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module uses cryptographic constructions that do not align with current security best practices.

The module performs certain signature comparisons using non constant-time comparison logic and generates SAML request identifiers using predictable values derived from non-cryptographic random number generation.

While no practical authentication bypass has been demonstrated as a result of these weaknesses alone, they may reduce the overall security margin of SAML authentication workflows.

Solution: 

Install the latest version:

• Upgrade to SAML SSO - Service Provider 3.2.0.

Reported By: 

• Sudhanshu Dhage (sudhanshu0542)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Open redirectAffected versions: <3.2.0CVE IDs: CVE-2026-87945Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The miniorange_saml module does not sufficiently validate certain user-supplied URLs before performing redirects.

An attacker could cause users to be redirected to an external website after authentication. This could be used in phishing attacks or to increase the credibility of malicious links.

Solution: 

Install the latest version:

• Upgrade to miniorange_saml 3.2.0.

Reported By: 

• Sudhanshu Dhage (sudhanshu0542)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Improper certificate validationAffected versions: <3.2.0CVE IDs: CVE-2026-87944Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not properly validate TLS certificates when making outbound HTTPS requests.

An attacker in a position to intercept network traffic could impersonate a trusted remote service and influence communications performed by the module.

This vulnerability is mitigated by the fact that an attacker must be able to
intercept or redirect network traffic originating from the site.

Solution: 

Install the latest version:

• Upgrade to miniorange_saml 3.2.0

Reported By: 

• Jonni Kalpio (thatguy)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team