Drupal SAML SSO CVE-2026-87944

Exploitation requires the attacker to occupy an Adversary-in-the-Middle position on the network path between the Drupal SAML Service Provider and its SAML Identity Provider, then leverage the module's failure to properly validate the TLS/certificate of that connection (CWE-295) to intercept or manipulate the SAML exchange. Affects SAML SSO - Service Provider versions from 0.0.0 up to and including 3.2.0. Key limiting factor: despite AV:N and PR:N (unauthenticated), the high attack complexity (AC:H) reflects the hard precondition of an active MITM foothold on the SP↔IdP channel; without that position the flaw cannot be triggered, and impact is confined to limited confidentiality and integrity (A:N).

Signals align toward a genuine but low-urgency issue rather than an emergency. The CVSS 3.1 base score is 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N: network-reachable and unauthenticated, but high attack complexity because the attacker must first establish an Adversary-in-the-Middle (AiTM) position on the SP↔IdP TLS path, and impact is limited (C:L/I:L, no availability impact). EPSS is 0.10% (1st percentile), indicating a very low modeled probability of exploitation in the near term. There is no CISA KEV listing and no POC or exploit reference in the input, so this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a patch-this-month priority rather than act_now/emergency. The low EPSS is consistent with the high-complexity AiTM precondition - exploitation requires a privileged network position, which bounds real-world risk. No signals conflict here; the main caveat is that the exact fixed version is not stated in the supplied data (only that a patch is available and that ≤3.2.0 is affected).

An attacker who already holds a network man-in-the-middle position between the Drupal site (SAML Service Provider) and the SAML Identity Provider abuses the module's improper certificate validation to intercept or tamper with the TLS-protected SAML exchange. This could let them observe or alter limited SAML authentication data (consistent with C:L/I:L). No public exploit code is identified in the available sources, and the AiTM prerequisite (reflected in AC:H) significantly limits practical exploitation.