Drupal SAML SSO CVE-2026-87947

Exploitation requires that the target Drupal site has the SAML SSO - Service Provider module installed and configured to act as a SAML Service Provider consuming signed assertions, at a version from 0.0.0 up to and including 3.2.0. The attacker must craft a SAML response/assertion carrying a spoofed or manipulated signature that the module's improper verification logic (CWE-347) accepts. Limiting factors: the CVSS high attack complexity (AC:H) indicates forging an accepted signature is non-trivial and not a simple repeatable step; the precise trigger condition (e.g., signature wrapping, missing signature enforcement, or key confusion) is not described in the available sources, so the practical difficulty cannot be fully characterized. No user interaction or prior authentication is required per the vector (UI:N, PR:N).

This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 base score is 4.8 (medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N: network-reachable and unauthenticated (PR:N), but high attack complexity (AC:H) and only low confidentiality and integrity impact with no availability impact. EPSS is very low at 0.10% (1st percentile), indicating essentially no observed or predicted mass-exploitation activity. The vulnerability is NOT listed in CISA KEV, so there is no public evidence of active exploitation - no public exploit identified at time of analysis (the only references are the Drupal security advisory and the NVD/EUVD entry; no PoC or exploit reference is present). The vuln.today decision label is 'this_month', which is a routine-patching urgency, not act_now or emergency, and this is consistent with the low EPSS, medium CVSS and absence of KEV. One point worth flagging: a signature-spoofing flaw (CWE-347) in an SSO Service Provider can in principle enable authentication impersonation, which would argue for higher integrity/confidentiality impact than the vendor's C:L/I:L rating suggests; the low scores likely reflect the high complexity of forging an accepted signature and limited practical leverage, but defenders relying on this module for identity assertions should treat the integrity dimension seriously. No SSVC automatable/technical-impact fields were supplied, so that framework cannot be cross-referenced.

An attacker crafts a malicious SAML response or assertion with a forged or manipulated signature and submits it to a Drupal site running the SAML SSO - Service Provider module; because the module improperly verifies the cryptographic signature, the spoofed assertion is accepted as authentic, potentially letting the attacker impersonate a user or access information they should not. The high attack complexity (AC:H) means the attacker must successfully construct a signature that defeats the flawed verification, and no public exploit code or PoC reference is identified at time of analysis.