Drupal SAML SSO EUVD-2026-107849

Exploitation requires the attacker to first capture a valid SAML authentication response/assertion issued for a legitimate user and then replay it to the Drupal SAML SSO - Service Provider module (CWE-294 capture-replay), affecting all versions from 0.0.0 up to but not including 3.2.0. The high attack complexity (AC:H) reflects that a replayable valid assertion must be obtained before the bypass works; the available sources do not describe the specific condition (e.g., missing nonce, assertion-ID reuse window, or absent timestamp validation) that allows the replay to be accepted, so that detail is not verified. Limiting factors: impact is confined to low integrity (C:N/I:L/A:N), the module must be deployed and relying on SAML SSO, and the attacker must be positioned to capture a valid assertion; upgrading to the fixed release (3.2.0 per the affected-range boundary) remediates the issue as the vendor advisory indicates.

This is a low-severity issue and the signals are consistent in pointing to low real-world urgency. The CVSS 3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - network-reachable but high attack complexity, only low integrity impact and no confidentiality or availability impact. EPSS is 0.19% (8th percentile), indicating a low modeled probability of exploitation, and the vulnerability is NOT on CISA KEV, with no public exploit identified at time of analysis. The vuln.today decision label is 'monitor', which aligns with the low CVSS and low EPSS rather than any urgent action. There are no conflicting signals here: every source agrees this is a genuine but low-priority flaw. The AC:H rating is consistent with CWE-294 (capture-replay), where the attacker must first obtain a valid captured SAML message before a replay can succeed - a non-trivial precondition that limits mass exploitation. Note one definitional caveat: the input vector sets PR:L, but a capture-replay attacker typically replays another party's assertion rather than using their own authenticated session, so the privilege precondition is better described as 'possession of a captured valid SAML assertion' than as attacker account privileges - verify intended auth model with the vendor advisory.

An attacker who can observe or otherwise obtain a victim's valid SAML authentication response (for example via network interception on an improperly protected channel) replays that captured assertion to the Drupal SAML SSO Service Provider to be accepted as the victim without presenting fresh credentials. Because of the high attack complexity, the attacker must first capture a valid, still-acceptable SAML message, which constrains opportunistic use. No public exploit code has been identified for this issue at time of analysis.