Drupal SAML SSO CVE-2026-87953

Exploitation requires high privileges (PR:H) - in a Drupal SAML SSO Service Provider deployment this corresponds to an account able to influence the module's SAML/IdP configuration, not an anonymous remote user. The CVSS vector also specifies high attack complexity (AC:H), indicating conditions outside the attacker's direct control must be met, and no user interaction (UI:N). The available sources do not name the exact feature, setting, or request flow that triggers the SSRF, so the specific configuration prerequisite is not described in the available sources. Limiting factors that reduce realistic risk: the privileged-access requirement, the high attack complexity, and impact limited to low confidentiality and low integrity with no availability effect. Affected deployments are those running SAML SSO - Service Provider versions from 0.0.0 up to (but not including) 3.2.0.

This is a low-severity, low-urgency issue, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.3 (LOW) with vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N: although network-reachable (AV:N), exploitation requires high privileges (PR:H) and high attack complexity (AC:H), with only limited confidentiality and integrity impact and no availability impact. The EPSS score of 0.15% (4th percentile) indicates a very low modeled probability of exploitation, aligning with the vuln.today Decision label of 'monitor'. The CVE is NOT on the CISA KEV list and no public exploit reference is present in the input, so there is no public exploit identified at time of analysis. The combination of SSRF (CWE-918) with PR:H is notable: in a Drupal SAML Service Provider context, the privileges required are typically those of an administrator who can already configure the module, which substantially blunts real-world risk. Net assessment: this is a genuinely low-priority issue - not a high-CVSS-but-low-real-risk mismatch, but simply a low-risk finding across all signals. The appropriate action per the Decision label is to monitor and apply the available vendor patch during normal maintenance.

An authenticated user already holding the high-privilege/administrative access needed to influence the SAML Service Provider configuration abuses the SSRF flaw to make the Drupal server issue requests to attacker-chosen internal or external endpoints, potentially reaching internal services or returning limited data. The high attack complexity (AC:H) means success depends on conditions not fully under the attacker's control, and no public exploit is identified at time of analysis. The precise trigger is not described in the available sources.