Drupal SAML SSO CVE-2026-87949

Per the vendor CVSS, exploitation requires a high-privilege (PR:H) authenticated account on a Drupal site with the SAML SSO - Service Provider module installed at any version from 0.0.0 up to and including 3.2.0; the vector also assigns high attack complexity (AC:H). The specific product feature, input field, or configuration that triggers the Cross-Site Scripting is not described in the available sources. Limiting factors that reduce realistic risk: the high-privilege prerequisite (an attacker must already be a trusted/administrative user), the stated high attack complexity, and the confinement to this specific contrib module rather than Drupal core.

This is a low-severity issue that is not a patching emergency. The vendor CVSS of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) reflects network reachability but high attack complexity and a requirement for high privileges (PR:H), with only limited confidentiality and integrity impact and no availability impact. EPSS agrees with the low urgency: 0.16% (5th percentile) indicates minimal expected exploitation. The CVE is NOT on CISA KEV and there is no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'monitor,' consistent with all signals pointing the same direction - no conflict between CVSS, EPSS, and KEV here. One caveat worth verifying: PR:H plus C:L/I:L for a Cross-Site Scripting flaw (CWE-79) is unusual, since XSS typically needs a victim to render the payload (UI:R) rather than UI:N; the vendor-assigned vector should be reconciled against the actual trigger, which is not described in the available sources.

An attacker who already holds a high-privilege account in a Drupal site running the SAML SSO - Service Provider module (<= 3.2.0) injects unsanitized input that is reflected or stored during web page generation, causing script to execute in another user's browser session. No public exploit code or PoC reference was provided, and the specific injection point is not described in the sources. The high-complexity, high-privilege requirement means this is a hard-to-reach, limited-impact scenario rather than a drive-by attack.