Drupal SAML SSO Service Provider CVE-2026-87951

Exploitation requires an authenticated account with high privileges (PR:H) on a Drupal site that has the SAML SSO - Service Provider contrib module installed and enabled at version 3.2.0 or earlier. The description states the sensitive data is stored insecurely ('Insecure Storage of Sensitive Information') allowing retrieval of embedded sensitive data, but the specific feature, storage location, or configuration that exposes the data is not described in the available sources. Limiting factors: the high-privilege requirement substantially narrows the attacker population to trusted/administrative users or already-compromised privileged accounts, no user interaction is needed (UI:N), and sites not running this particular contrib module are unaffected. Updating to the vendor-patched release is the remediation indicated by the advisory.

This is a low-severity, low-priority issue despite being network-reachable. The CVSS 3.1 base score is 3.8 with vector AV:N/AC:L/PR:H/UI:N, meaning exploitation requires an attacker who already holds high privileges (PR:H) on the Drupal instance - so this is a privileged-insider or post-compromise information-disclosure problem, not a remote unauthenticated takeover. The EPSS score of 0.15% (4th percentile) indicates very low expected exploitation activity, and the vuln.today decision label is 'monitor' rather than act_now or emergency, which is consistent across all signals. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis. CWE-922 (Insecure Storage of Sensitive Information) aligns with the description's 'Retrieve Embedded Sensitive Data' and the C:L/I:L/A:N impact. All signals agree this is a genuinely low-risk, low-urgency issue: the high-privilege precondition, low EPSS, absence of KEV, and 'monitor' decision all point the same direction. One minor note: the supplied vector lists I:L (low integrity impact), but the description characterizes the flaw purely as insecure storage enabling retrieval of sensitive data, which is a confidentiality concern - the basis for the integrity impact is not described in the available sources.

An authenticated user or compromised account with high privileges on a Drupal site running the SAML SSO - Service Provider module (version 3.2.0 or earlier) accesses the location where the module stores sensitive SAML-related data and retrieves embedded secrets (e.g., configuration or credential material). No public exploit code has been identified, and the precise storage location and trigger are not described in the available sources.