Drupal SAML SSO CVE-2026-87948

Exploitation requires an attacker with a high-privilege account (CVSS PR:H) on a Drupal site running the SAML SSO - Service Provider module at a version from 0.0.0 up to and including 3.2.0, plus interaction from a victim user (UI:R) who must load the page carrying the injected payload. The available sources do not identify the exact feature, field, or configuration setting that fails to neutralize input, so the precise injection point is not described. Limiting factors that reduce realistic risk: the module must be installed and enabled, the attacker must already possess elevated privileges, a separate victim must view the malicious content, and the impact is bounded to low confidentiality and low integrity with no availability effect.

All signals converge on low real-world risk. The CVSS 3.1 base score is 3.5 (Low) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - network-reachable but gated behind high privileges (PR:H) and requiring victim user interaction (UI:R), with only limited confidentiality and integrity impact and no availability impact, consistent with a CWE-79 cross-site scripting flaw in an administrative/configuration surface. EPSS is 0.16% (5th percentile), indicating very low statistical likelihood of exploitation. There is no CISA KEV listing and no public exploit or PoC reference in the supplied data (the only references are the Drupal security advisory and the NVD detail page), so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'monitor', the lowest urgency tier, which agrees with the low CVSS and low EPSS - these signals are mutually consistent, not conflicting. Net: this is a genuinely low-priority, high-privilege XSS, not a high-CVSS-but-low-risk mismatch; patch it in the normal maintenance cycle rather than as an emergency.

An attacker who already holds a high-privileged account on the Drupal site injects a malicious script payload through the SAML SSO - Service Provider module, which is stored or reflected without proper neutralization. When another user (such as an administrator) views the affected page, the script executes in their browser session. No public exploit code is identified for this issue at time of analysis.