Saml Sso Service Provider CVE-2026-3217

Although CVSS and EPSS scores are not provided in the available intelligence, the risk profile of this vulnerability is moderately high to high based on attack vector and impact factors. XSS vulnerabilities in authentication modules are particularly concerning because they operate at the security perimeter where users are most vulnerable—during login flows where phishing and credential harvesting are most effective. The attack vector is likely to be Network (no special access required), and depending on implementation, the complexity may be Low (simple payload injection). The technical impact includes confidentiality breach (session cookies, SAML tokens), integrity compromise (form modification, redirect attacks), and availability degradation. The absence of CVSS/EPSS data suggests this advisory is recent; however, the CVE date (2026) and ENISA EUVD registration (EUVD-2026-15477) confirm formal disclosure. Without KEV status or public POC data in the provided intelligence, the real-world exploitation risk cannot be definitively quantified, but the attack surface (SAML endpoints) and victim pool (Drupal installations using enterprise SSO) suggest this warrants rapid patching.

An attacker intercepts or crafts a malicious SAML assertion containing JavaScript payload in an attribute field (e.g., user email or display name) that is rendered on the authentication confirmation page or user profile without encoding. When a victim completes SAML authentication, the payload executes in their browser within the context of the vulnerable Drupal site, allowing the attacker to steal the user's session cookie or SAML authentication token, redirect them to a phishing site, or perform actions on their behalf within the Drupal system. The attack requires no special privileges and can be delivered via a compromised identity provider, man-in-the-middle position, or if the module is vulnerable to DOM-based XSS, through manipulation of the HTTP request itself.