Drupal SAML SSO CVE-2026-87945

Exploitation requires the Drupal SAML SSO - Service Provider contributed module installed at version 0.0.0 through 3.2.0 and a victim who clicks an attacker-crafted link (UI:R), so it cannot be triggered without user interaction. No authentication is required of the attacker (PR:N). The specific vulnerable redirect parameter or endpoint is not described in the available sources (only the vendor advisory is referenced). Limiting factors: the need for social-engineering a user into clicking, impact confined to redirection/phishing rather than code execution or availability loss, and applicability only to Drupal sites that have this specific contrib module enabled at an affected version. The vendor-provided fix (upgrade past 3.2.0) is available and, per the advisory, updating is the remediation.

This is a medium-severity open-redirect flaw (CVSS 5.4) whose signals consistently point to low real-world urgency rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows a network-reachable, low-complexity, unauthenticated issue, but exploitation hinges on user interaction (UI:R) - a victim must click an attacker-crafted link - and impact is limited to low confidentiality and low integrity with no availability effect, consistent with an open redirect used to lend legitimacy to phishing. EPSS is low at 0.14% (3rd percentile), the CVE is not listed in CISA KEV, and no exploit or PoC reference is present - only the Drupal vendor advisory and the NVD detail page. These signals align: low probability of exploitation, no confirmed active exploitation, and no public exploit identified. The vuln.today decision label is 'this_month,' which is a routine patch-cycle priority, not act_now or emergency, and it is coherent with the low EPSS and absence of KEV. No signals conflict here. The one thing worth verifying is impact scoping: for a pure open redirect, confidentiality/integrity impact is often rated N, so the vendor's C:L/I:L may reflect SAML-flow data (e.g., relay/assertion leakage to the redirect target) - confirm the exact mechanism in the Drupal advisory sa-contrib-2026-143.

An attacker crafts a URL pointing at a site running the Drupal SAML SSO - Service Provider module (<=3.2.0) that abuses an unvalidated redirect parameter so the application forwards the victim to an attacker-controlled domain. The victim, trusting the legitimate initial domain, clicks the link (UI:R) during or after an SSO flow and is sent to a lookalike page used for phishing or to capture SSO-related data. No public exploit code is identified at time of analysis; the trigger details are described only in the vendor advisory.