Drupal SAML SSO CVE-2026-87946

Requires the Drupal site to be running the SAML SSO - Service Provider contrib module at a version below 3.2.0, and requires the attacker to have network access to the SAML service-provider endpoints that exhibit the measurable timing discrepancy. The description does not name the specific feature, parameter, or secret whose comparison leaks timing, so the exact triggering request is not described in the available sources. Limiting factors: exploitation is unauthenticated (PR:N) but rated high-complexity (AC:H) because an observable-timing attack demands many repeated, precisely-timed measurements to extract signal from network latency and jitter, making it far less reliable than a direct network exploit; the practical impact is bounded (C:L/I:L/A:N).

This is a moderate-severity information-disclosure issue (CVSS 4.8, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) that scores as a genuine but low-urgency problem. The signals are consistent and point AWAY from an emergency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit or PoC reference appears in the input (no public exploit identified at time of analysis). The CVSS vector itself tempers the network reachability - AC:H reflects that exploiting an observable timing discrepancy (CWE-208) requires many measurements against network-induced jitter, and the impact is limited to C:L/I:L with no availability effect. The vuln.today decision label is 'this_month', which aligns with the low EPSS/no-KEV picture: schedule the patch, do not drop everything. One caveat to verify: the description says the flaw 'allows Brute Force' but does not state WHAT is brute-forced (a login response, a SAML token value, a user-enumeration oracle) - the practical confidentiality/integrity consequence therefore cannot be confirmed from the available sources and should be clarified against the vendor advisory sa-contrib-2026-144.

An unauthenticated remote attacker repeatedly submits requests to a Drupal site running the SAML SSO - Service Provider module and measures small, consistent differences in server response time to infer secret-dependent state, using that oracle to accelerate a brute-force guessing attack. No public exploit or PoC is identified in the available sources, and the CVSS AC:H rating reflects that reliable exploitation requires large numbers of timed samples to overcome network noise.